A fake LiteLLM release stole AI and cloud keys for two hours. Check whether anything installed 1.107.0

LiteLLM sits between many companies’ apps and their AI providers, which means it holds the API keys for all of them. On Wednesday morning, attackers took over its release pipeline and published a version that steals those keys and much more.

The bad packages were up for about two hours on PyPI and a little longer on Docker Hub. If anything in your company installed or started LiteLLM in that window, LiteLLM says to assume it was compromised.

If a server installed LiteLLM 1.107.0, LiteLLM says to treat it as compromised. Rebuild it and rotate every key it could reach.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

A fake LiteLLM 1.107.0 release stole credentials for two hours

LiteLLM says litellm==1.107.0 was live on PyPI from 11:39 to 13:23 UTC on October 21 (7:39 to 9:23 AM Eastern). The Docker tags v1.107.0, latest, main-latest and main-stable pointed at a malicious image from 11:46 to 14:20 UTC on Docker Hub; GHCR copies were pulled by 13:51 UTC.

JFrog found three extra files in every 1.107.0 wheel: cook.pth, cook.py and sitecustomize.py. They run whenever Python starts in that environment, even if the app never imports LiteLLM. The payload collects cloud, Kubernetes, Git, PyPI and CI credentials, .env files, SSH keys and browser data, and checks in hourly for new code to run.

LiteLLM says the attacker used GitHub CLI tokens taken from logs on an internet-facing internal LiteLLM deployment, including one belonging to an organization owner, to override branch protection and publish from a lookalike repository. The official 1.107.0 source tag is clean.

AI gateways and Python apps that pulled LiteLLM on October 21

LiteLLM gets about 92 million monthly downloads on PyPI, BleepingComputer reports. Anything that installs it unpinned, such as a CI job, a developer laptop or a container pulling latest, could have picked up the bad version. Enterprise customers on LiteLLM’s private registry were not affected.

This is the second time LiteLLM releases have been hijacked this year, after the March compromise, and JFrog says no evidence links the two campaigns.

Find any 1.107.0 install, rebuild on 1.106.2 and rotate keys

• Run pip show litellm across hosts and images, and check container logs for the image digest sha256:1bbcb1443bc9… or any latest/main-stable pull during the window.
• Search site-packages for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py. Do not run pip or Python on a suspect host first, because that starts the payload again.
• On an affected host, delete those files from the shell, kill the daemon holding /tmp/remote_code_loader.lock, then rebuild from scratch pinned to litellm==1.106.2.
• Rotate everything the host could reach: cloud roles, every provider key stored in the LiteLLM proxy database, master and virtual keys, the database password and all environment secrets.

Details

• Malicious artifacts: PyPI litellm==1.107.0 (all seven wheels); Docker Hub and GHCR tags v1.107.0, latest, main-latest, main-stable; ghcr.io/berriai/litellm, litellm-database and litellm-non_root.
• Exfiltration: data encrypted with AES-256 and RSA-4096 and sent to litellm[.]dev/healthcheck, according to BleepingComputer.
• Safe version: 1.106.2, or any explicit version published before October 21.
• CVE: none assigned. This is a supply-chain compromise, not a code flaw.

Hunt / verify

• Check CloudTrail for GetCallerIdentity calls from instance roles around install time, then for use of those role credentials from outside your network, as LiteLLM advises.
• Look for outbound traffic to litellm[.]dev from build agents, proxies and developer machines.
• LiteLLM says a missing marker file proves nothing, because container restarts and tmp cleanup remove it.

Source: LiteLLM incident report, October 21, 2026; JFrog analysis

Sources

• LiteLLM: Oct 21, 2026 LiteLLM release v1.107.0 compromised
• JFrog Security Research: LiteLLM Hijacked Again
• Datadog Security Labs: LiteLLM supply chain compromise
• BleepingComputer: LiteLLM release pipeline hacked to distribute info-stealer malware

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].