// AI threat desk · 2 Nov 2026
Home/SUPPLY · AI Supply Chain
AI Supply ChainMediumPYPICVSS not assigned

LiteLLM 1.107.0 malicious release could expose credentials and AI tokens

Cybersecurity News said a malicious LiteLLM 1.107.0 release reportedly reached PyPI with a credential stealer and remote-access malware. HKCERT disclosed the findings on Oct 31, 2026.

· 2 min read
AI-generated image of security analysts examining a suspicious software package alert in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • Cybersecurity News said the malicious LiteLLM 1.107.0 release reportedly reached PyPI with a credential stealer and remote-access malware.
  • The payload searched for cloud credentials, SSH keys, browser information and AI service tokens.
  • Python startup hooks could activate the payload through a routine command without an application explicitly importing LiteLLM.

LiteLLM version 1.107.0 reportedly reached PyPI with a credential stealer and remote-access malware, Cybersecurity News said.org/security-news/hacktober-cyberattack-wave-hits-php-nodejs-binance-litellm-pentagon-and-a-few-more). HKCERT published its report on Oct 31, 2026.

The malicious code searched for cloud credentials, SSH keys, browser information and AI service tokens. Python startup hooks meant a routine Python command in a contaminated environment could activate the payload without an application explicitly importing LiteLLM.

That widened the risk to build jobs and maintenance tasks that might not appear directly connected to the affected application. LiteLLM is an open-source large language model gateway used in AI-assisted software development, providing a unified API for accessing and routing requests to different AI model providers.

On this page

Python startup hooks activated the payload outside direct imports

HKCERT said the attack did not depend on an application explicitly importing LiteLLM. A routine Python command inside a contaminated environment could activate the payload.

All seven LiteLLM wheel files carried the reported malicious release

Cybersecurity News said the malicious version affected all seven wheel files. It said affected container tags also extended exposure beyond users who installed the Python package directly.

Cybersecurity News said reporting linked the compromised release to stolen GitHub credentials and a workflow redirected toward a lookalike repository. Stolen AWS credentials were reportedly used within roughly four and a half hours.

HKCERT said recovery required treating credentials available to the affected environment as potentially stolen, replacing contaminated software and rebuilding from a trusted source. A downgrade alone would not reverse that exposure.

Cybersecurity News said affected container tags extended exposure beyond users who installed the Python package directly. It also said reporting linked the release to stolen GitHub credentials and a workflow redirected toward a lookalike repository.

FAQ

What happened to LiteLLM 1.107.0?

Cybersecurity News said version 1.107.0 reportedly reached PyPI with a credential stealer and remote-access malware across all seven wheel files.

What information did the malicious LiteLLM code search for?

HKCERT said it searched for cloud credentials, SSH keys, browser information and AI service tokens.

Could the LiteLLM payload run without an application importing LiteLLM?

Yes. HKCERT said Python startup hooks allowed execution without an application explicitly importing LiteLLM, and a routine Python command in a contaminated environment could activate it.

Are LiteLLM container users affected?

Cybersecurity News said affected container tags extended exposure beyond users who installed the Python package directly.

Does downgrading LiteLLM remove the exposure?

No. HKCERT said a downgrade alone would not reverse the exposure and that recovery required treating available credentials as potentially stolen, replacing contaminated software and rebuilding from a trusted source.

Sources

  1. Hacktober – Cyberattack Wave Hits PHP, Node.js, Binance, LiteLLM, Pentagon, and a Few More, HKCERTPrimary
  2. LiteLLM, Wikipedia
How we checked this story
ClaimSourceStatus
Cybersecurity News said liteLLM version 1.107.0 reportedly reached PyPI with a credential stealer and remote-access malware.Cybersecurity News, via HKCERTAttributed
Cybersecurity News said the malicious LiteLLM code affected all seven wheel files.Cybersecurity News, via HKCERTAttributed
Cybersecurity News said affected LiteLLM container tags extended exposure beyond users who installed the Python package directly.Cybersecurity News, via HKCERTAttributed
The malicious code searched for cloud credentials, SSH keys, browser information, and AI service tokens.HKCERTConfirmed
Python startup hooks allowed the attack to execute without an application explicitly importing LiteLLM.HKCERTConfirmed
A routine Python command inside a contaminated environment could activate the payload.HKCERTConfirmed
The attack widened risk to build jobs and maintenance tasks that might not appear directly connected to the affected application.HKCERTConfirmed
Cybersecurity News said reporting linked the compromised release to stolen GitHub credentials and a workflow redirected toward a lookalike repository.Cybersecurity News, via HKCERTAttributed
Cybersecurity News said stolen AWS credentials were reportedly used within roughly four and a half hours.Cybersecurity News, via HKCERTAttributed
A downgrade alone would not reverse exposure from the malicious LiteLLM release.HKCERTConfirmed
Recovery required treating credentials available to the affected environment as potentially stolen, replacing contaminated software, and rebuilding from a trusted source.HKCERTConfirmed
LiteLLM is an open-source large language model gateway used in AI-assisted software development.WikipediaConfirmed
LiteLLM provides a unified API for accessing and routing requests to different AI model providers.WikipediaConfirmed
HKCERT published its report on Oct 31, 2026.HKCERTConfirmed

Could not verify

  • Whether the malicious LiteLLM release led to confirmed successful compromise of any specific victim is not established
  • Whether the release was removed from PyPI or when it was fixed is not established
  • How many users or organizations were affected is not established
  • Whether the stolen credentials were used beyond the reported AWS activity is not established
HKCERT
See all in AI Supply Chain →
Explore with AI
ChatGPT
Claude
Perplexity
Grok