// AI threat desk · 27 Oct 2026
Home/SUPPLY · AI Supply Chain
AI Supply ChainHighSUPPLYCVSS not assigned

LiteLLM pipeline compromise published compromised version 1.107.0

LiteLLM published compromised 1.107.0 packages to PyPI and container registries on Oct 21. LiteLLM disclosed the incident on Oct 23.

· 2 min read
AI-generated image of a security analyst reviewing blurred package and container security dashboards in an operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • LiteLLM published compromised version 1.107.0 to PyPI and its container registries on Oct 21.
  • The attacker dispatched the staging workflow with its source set to the lookalike Berri-AI/litellm repository at commit 20535d8f.
  • The pipeline signed and published version 1.107.0 built from the fork commit.

LiteLLM said its release pipeline published a compromised litellm==1.107.0 to PyPI and its container registries on Oct 21.

The malicious package placed files that execute whenever a Python interpreter starts. The malware targets API keys for OpenAI, Anthropic, Cohere and other LLM providers.

LiteLLM is an open-source LLM gateway developed by BerriAI that provides an OpenAI-compatible API for different model providers. The company’s disclosure was published on Oct 23.

On this page

An exposed Agent Platform key led to repository control

On May 27, 2026, a configuration file committed to the public LiteLLM-Labs/lite-harness repository inadvertently contained the master key to a LiteLLM Agent Platform deployment.

On Oct 10, the attacker used that key to access the Agent Platform and extract a GitHub CLI OAuth token. That token provided owner-level access to all LiteLLM GitHub repositories.

The attacker then ran a workflow that posted six repository secrets to an attacker-controlled webhook.site endpoint.

The attacker changed the build and signed the release

The attacker disabled branch protections and then force-pushed with the owner’s token.

The attacker dispatched the staging workflow with its source set to the lookalike Berri-AI/litellm repository at commit 20535d8f. The pipeline signed and published v1.107.0 built from the fork commit.

The package and Docker tags were available for limited windows

LiteLLM said the malicious PyPI package was live for approximately two hours, from 11:39 UTC to 13:23 UTC. Its compromised Docker images were available from 11:46 UTC to 14:20 UTC.

Wiz said ClickPy data showed approximately 49,000 downloads of the malicious version. It observed activity in which attackers checked AWS credentials with sts:GetCallerIdentity and then enumerated AI models, activity it described as consistent with LLMjacking.

LiteLLM advised affected users to pin their installations to version 1.106.2 or another explicitly published earlier version, and to delete the malware files from affected site-packages directories.

The company also advised users to rotate everything the host could reach, in particular the instance/task IAM role.

What to do now

  1. Rotate everything listed above that the host could reach. In particular: the instance/task IAM role.

FAQ

What happened to LiteLLM 1.107.0?

LiteLLM said its release pipeline published a compromised litellm==1.107.0 to PyPI and its container registries on October 21.

Which LiteLLM versions and images were affected?

The affected PyPI release was litellm==1.107.0. The compromised Docker tags were v1.107.0, latest, main-latest and main-stable.

What did the LiteLLM malware do?

It extracted cook.pth, cook.py and sitecustomize.py into the site-packages root, where they were designed to execute when a Python interpreter started. It targeted API keys for OpenAI, Anthropic, Cohere and other LLM providers.

How did the attacker reach LiteLLM’s release pipeline?

A configuration file committed on May 27 inadvertently contained the master key to a LiteLLM Agent Platform deployment. On October 10 the attacker used it to extract a GitHub CLI OAuth token, which gave owner-level access to all repositories in LiteLLM’s GitHub.

How should affected LiteLLM users respond?

LiteLLM advised users to pin their version to 1.106.2 or any explicit version published prior, delete the listed malware files, and rotate everything the host could reach, in particular the instance/task IAM role.

Sources

  1. LiteLLM Compromised, Steals Credentials | Wiz Blog, WizPrimary
  2. The attack chain behind the v1.107.0 LiteLLM release | liteLLM, LiteLLMPrimary
  3. Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised | liteLLM, LiteLLMPrimary
  4. LiteLLM hit by second supply chain attack this year, users urged to rotate credentials, Help Net Security
  5. LiteLLM, Wikipedia
How we checked this story
ClaimSourceStatus
LiteLLM published compromised version 1.107.0 to PyPI and its container registries on October 21.LiteLLMConfirmed
The attacker used the exposed key on October 10 to access the Agent Platform and extract a GitHub CLI OAuth token.LiteLLMConfirmed
The attacker obtained owner-level access to all LiteLLM GitHub repositories through the extracted token.LiteLLMConfirmed
Wiz said the malicious LiteLLM package was downloaded approximately 49,000 times.WizAttributed
The malicious package extracted files that executed whenever a Python interpreter started.WizConfirmed
Wiz observed attackers validating stolen AWS credentials and enumerating AI models in activity consistent with LLMjacking.WizConfirmed
The compromised PyPI package remained available for approximately two hours, from 11:39 UTC to 13:23 UTC.LiteLLMConfirmed
LiteLLM’s compromised Docker tags were available from 11:46 UTC to 14:20 UTC.LiteLLMConfirmed
LiteLLM advised affected users to delete the malware files from every affected site-packages directory.LiteLLMConfirmed
Help Net Security reported that LiteLLM 1.107.0 was compromised on PyPI and Docker with malware stealing cloud logins, developer secrets and AI keys.Help Net SecurityAttributed
LiteLLM is an open-source LLM gateway developed by BerriAI that provides an OpenAI-compatible API for different model providers.WikipediaConfirmed
wiz.io published its report on Oct 21, 2026.wiz.ioConfirmed
docs.litellm.ai published its report on Oct 23, 2026.docs.litellm.aiConfirmed
docs.litellm.ai published its report on Oct 21, 2026.docs.litellm.aiConfirmed

Could not verify

  • Whether the attacker successfully accessed or misused every stolen credential is not established.
  • How many organizations were affected is not established.
  • Whether the suspected vulnerability in LiteLLM’s internal deployment enabled the initial access is not established.
  • Whether any confirmed customer breach resulted from the malicious release is not established.
See all in AI Supply Chain →
Explore with AI
ChatGPT
Claude
Perplexity
Grok