LiteLLM Supply Chain Attack Compromises Version 1.107.0 on PyPI and Docker

On October 21, 2026, attackers published malicious versions of the LiteLLM Python package and Docker images that contained credential-stealing malware. The compromised artifacts remained available for roughly two hours before maintainers removed them.

LiteLLM Supply Chain Attack Details and Scope

The malicious release targeted version 1.107.0. All seven wheel files on PyPI and multiple Docker tags including v1.107.0, latest, main-latest, and main-stable carried the payload. The affected Docker image carried the digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e. PyPI records show approximately 49,000 downloads of the tainted package before removal.

Malware installed files named cook.pth, cook.py, and sitecustomize.py into the site-packages directory. These files executed automatically whenever any Python interpreter started, regardless of whether LiteLLM itself was imported. The code harvested browser passwords and cookies, SSH and GPG keys, cloud provider credentials from AWS, GCP, and Azure, Kubernetes and Docker tokens, CI secrets, environment files, and LiteLLM proxy database tables. Data was encrypted with AES-256 and RSA-4096 before exfiltration to an attacker-controlled endpoint. A background process on Linux and macOS enabled repeated remote code execution.

Enterprise private-registry releases and the official GitHub source tag for v1.107.0 remained unaffected. The malicious artifacts originated from an attacker-controlled lookalike repository rather than the primary LiteLLM project.

Attack Chain and Immediate Consequences

Investigators traced the breach to a master key for an internal LiteLLM Agent Platform that had been committed to a public repository on May 27, 2026, and never revoked. On October 10 the key was used to obtain a GitHub organization-owner OAuth token. Attackers then extracted two additional maintainer tokens through CI workflows, allowing them to bypass branch protections, redirect the release workflow, approve the malicious build, and delete logs.

Stolen AWS credentials appeared in use shortly after the malicious packages were published. This incident marks the second supply-chain compromise for LiteLLM in 2026, following earlier tainted versions in March. Researchers from multiple security firms confirmed the timeline through registry logs and forensic analysis of the removed artifacts.

Remediation Steps for Affected Users

Organizations that installed litellm 1.107.0 or pulled the matching Docker images must assume credential exfiltration occurred if outbound network access was possible. Recommended actions include immediate rotation of all cloud roles, provider keys, database passwords, and SSH keys that were accessible in the environment. Administrators should delete cook.pth, cook.py, sitecustomize.py and associated .pyc files from every site-packages directory and terminate any daemon holding the file /tmp/remote_code_loader.lock.

Teams are advised to recreate virtual environments and container images from scratch using a clean version such as 1.106.2 pinned by digest. LiteLLM has stated it will issue a new release after implementing additional safeguards, though no specific date has been announced as of October 25, 2026. Users should monitor official channels for further updates on process changes.