Malware · AI Security
LiteLLM software update spread malware that stole developer credentials
Attackers compromised the LiteLLM release pipeline, pushing a malicious update that stole credentials from developer and production systems. The malware ran automatically in affected Python environments.
Ross GrantUpdated 3 min read
The short version
Hackers broke into the software release process for LiteLLM, a tool used by developers to connect to AI models. They published a bad update that secretly stole passwords, cloud keys, and other sensitive information from computers where it was installed. The malware ran automatically, even if you did not use LiteLLM directly. If you installed version 1.107.0, you should remove it and change your passwords and keys.
By the numbers
- 23 millionweekly LiteLLM downloadsThe Register
- 3 hourstime until malicious package was removedThe Hacker News
What happened?
Attackers compromised LiteLLM's release pipeline and published a malicious version (1.107.0) to PyPI and Docker Hub on 21 October 2026. The malware stole credentials and secrets from affected systems and sent them to an attacker-controlled server. The malicious package was removed within hours, but anyone who installed it is at risk.
Who is affected
Anyone who installed LiteLLM version 1.107.0 from the Python Package Index (PyPI) or used the corresponding Docker images between 11:39 a.m. and 1:23 p.m. UTC on 21 October 2026 may be affected. This includes developer workstations, CI/CD systems, test environments, and production deployments. LiteLLM is widely used as a gateway between applications and large language model (LLM) providers, with around 23 million weekly downloads, according to The Register (opens in a new tab).
What was taken
The malicious package was designed to collect a wide range of sensitive data. According to Microsoft (opens in a new tab) and The Register (opens in a new tab), it targeted:
- Developer credentials (including GitHub tokens)
- Cloud provider credentials (AWS, Google Cloud, Azure)
- API keys for LLM providers (OpenAI, Anthropic, Cohere)
- Database connection strings
- Browser data (Chrome, Firefox, Edge, Safari)
- SSH and GPG private keys
- Environment variables and shell history
The malware encrypted the stolen data and sent it to an attacker-controlled server.
How the attack worked
Attackers used stolen GitHub credentials to alter LiteLLM's release workflow. They redirected the release process to a lookalike repository and pushed a malicious version (1.107.0) to PyPI and Docker Hub (Microsoft (opens in a new tab), The Hacker News (opens in a new tab)).
The malicious package added Python startup files outside the normal application directory. This meant that simply starting Python in an affected environment (even without importing LiteLLM) would trigger the malware. The malware ran two main routines:
- A credential collector that harvested secrets from the system
- A remote access trojan (RAT) that could fetch and execute further code from the attacker's server on Unix systems
The attack used both .pth files and a sitecustomize.py file to ensure the malicious code ran automatically. This approach extended the risk to any system where the package was installed, not just those actively using LiteLLM.
The response
LiteLLM maintainers and PyPI removed the malicious package within three hours of its release. Docker images were also taken down. LiteLLM revoked all compromised GitHub tokens and restricted release permissions. They advised users to remove version 1.107.0, rotate all credentials, and investigate any system where the package may have run (The Hacker News (opens in a new tab)).
Microsoft and several security firms published detection and mitigation guidance. Security teams are urged not to start Python or pip in potentially affected environments, as this could trigger the malware. Instead, they should isolate and rebuild affected systems from clean backups, and rotate all credentials that may have been exposed.
What you should do
- Remove LiteLLM 1.107.0 and any related Docker images from your systems
- Isolate and investigate any environment where the malicious version was installed
- Rotate all credentials, tokens, and keys that could have been accessed
- Block access to the attacker's exfiltration domain (
litellm.dev) - Rebuild affected systems from clean sources
- Pin LiteLLM to a known safe version (such as 1.106.2)
If you use LiteLLM, check your environments for the presence of suspicious Python startup files (such as cook.pth, cook.py, and sitecustomize.py) and for indicators of compromise like /tmp/.pc_once_* or /tmp/remote_code_loader.lock (The Register (opens in a new tab)).
Why it matters
This attack shows how a single compromised software update can put thousands of organisations at risk. It highlights the dangers of supply chain attacks, where trusted tools are used to spread malware. Developers and security teams must verify software sources and be ready to respond quickly to incidents like this.
Key points
- Malicious LiteLLM update stole credentials from developer and production systems.
- The malware ran automatically in affected Python environments, not just when LiteLLM was used.
- Attackers used stolen GitHub credentials to hijack the release pipeline.
- All users of LiteLLM 1.107.0 should remove it, rotate credentials, and check for compromise.
- Supply chain attacks can affect even well-defended organisations.
Sources
Microsoft
Primary source
The Hacker News
Reference
- LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor (opens in a new tab)
thehackernews.com
- LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release (opens in a new tab)
thehackernews.com
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline (opens in a new tab)
thehackernews.com
- LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor (opens in a new tab)
The Register
Reference
CSO Online
Reference
BleepingComputer
Reference
SecurityWeek
Reference
