LiteLLM 1.107.0: the PyPI wheels and the official Docker images carried a credential stealer and a dormant remote-code loader that Python starts at every launch, published through the maintainers' own release workflow with stolen developer tokens
LiteLLM 1.107.0 on PyPI and in the official images stole cloud and AI credentials; removing the package does not stop it
Defender actions
- Find every host, build agent and container that installed litellm 1.107.0 from PyPI between 11:39 and 13:23 UTC on 2026-10-21, or pulled the v1.107.0, latest, main-latest or main-stable tag of the official GHCR or Docker Hub LiteLLM images between 11:46 and 14:20 UTC; treat each as compromised, inspect it with tooling that does not start Python in the affected environment, rebuild it from a reviewed artifact pinned to 1.106.2 or an image digest, and rotate every cloud, Kubernetes, registry, SSH, database and AI-provider credential it could read, including the provider keys stored in a LiteLLM proxy database.
Analysis
Socket reports that LiteLLM 1.107.0, an open-source LLM gateway, carries malicious Python startup files in all seven wheels, and that Upwind found the same payload in the published images (Socket, 2026-10-21). A startup hook and a second startup module in the Python library directory run at every Python start without the application importing LiteLLM: the first collects cloud, Kubernetes, CI, registry and database credentials, SSH, GPG and TLS private keys, browser stores, AI-tool credential files, environment variables and, where configured, the credentials saved in a LiteLLM proxy database; the second forks a detached loader that polls a file in a GitHub repository for a domain and would execute Python downloaded from it with no signature or hash check, though at 13:01 UTC the pointer returned an empty body, which stops the loader before its download stage (Socket, 2026-10-21).
The payload is not in the git tag: a packaging setting in an untagged commit pulls it into the wheel, and the container build provenance records a source repository named Berri-AI/litellm, one hyphen away from BerriAI/litellm (Socket, 2026-10-21). The maintainers say stolen GitHub CLI OAuth tokens of three engineers drove the release: one account started the run, another approved it, a third deleted the workflow records, and an organisation owner's token disabled branch protection so that a change pointing the releaser at the look-alike repository could be force-pushed (GitHub issue #47826, 2026-10-21; LiteLLM, 2026-10-21). They believe the tokens were read from the logs of an internet-exposed internal LiteLLM deployment, note that Claude Code can embed a user's GitHub CLI OAuth token in a response body that deployments log, and suspect, unconfirmed, a recently patched vulnerability; an embargoed fix for a vulnerability due for disclosure on 2026-10-27 goes to enterprise customers through a private registry (LiteLLM, 2026-10-21). PyPI quarantined 1.107.0 and the images were pulled the same day (Aikido, 2026-10-21; LiteLLM, 2026-10-21).
Cited evidence
contains malicious Python startup files that collect cloud credentials, private keys, browser data, and authentication files for AI development tools
starting Python or pip in an affected environment to inspect or repair the installation can execute the payload again
removing the LiteLLM package directory alone does not remove those files or stop an existing process
We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens.
We believe the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise our release workflow.
Each credential was checked with sts:GetCallerIdentity, followed by bedrock:ListFoundationModels and a ListModels call, consistent with LLMjacking.
PyPI has now quarantined version 1.107.0.
Sources5
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.