2026 LiteLLM — release pipeline compromised; malicious PyPI 1.107.0 and container tags stole credentials
Data compromised
Cloud and deployment credentials (AWS, Azure, Google Cloud, Kubernetes, Docker), AI provider credentials and LiteLLM configuration, developer secrets (Git, npm, PyPI, CI/CD, .env, SSH, GPG, TLS), browser data and host information. Stolen data was encrypted and uploaded to an attacker-controlled domain.
Technical writeup
Verified maintainer post-mortem (quoted by BleepingComputer, Oct 22): release pipeline compromised Oct 21, 2026. Malicious PyPI wheels for litellm 1.107.0 were live 11:39:51 to 13:23 UTC; Docker Hub tags (v1.107.0, latest, main-latest, main-stable) pointed at a compromised image index 11:46:56 to 14:20 UTC; GHCR tags were unavailable by 13:51 UTC. The package gained three files (cook.pth, cook.py, sitecustomize.py) in site-packages, so the payload runs whenever Python starts in the environment. The payload contacts a GitHub-hosted pointer hourly to fetch further code. Recovery version: 1.106.2. The private enterprise build was not affected. Initial access is not yet public. The maintainer confirmed the malware "steals credentials and loads remote-code execution tools." Scale: 92 million monthly PyPI downloads; no count of affected installs. recordsAffected 0.
Root cause
Release pipeline compromised on Oct 21, 2026; access route not disclosed in the maintainer post-mortem reported so far. The application source code was not changed; the installed package was modified.
References
- https://docs.litellm.ai/blog/security-incident-oct-21-2026
- https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/
- https://socket.dev/blog/litellm-compromise
- https://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials