LiteLLM Security Review: Supply Chain Compromise Through Malicious Package

LiteLLM version 1.107.0 contained malware that activated on Python startup and stole credentials from cloud providers, LLM keys, and environment variables. The package remained available for roughly two hours before removal from PyPI and container registries. Any system that installed the version or pulled affected Docker tags requires immediate credential rotation and environment cleanup.

LiteLLM Security Review of the October 2026 Attack Vector

Attackers used stolen GitHub CLI OAuth tokens belonging to three LiteLLM engineers to bypass branch protections and alter a private release workflow. The tokens likely originated from logs of an internet-exposed internal LiteLLM instance. Once inside the workflow, the attackers pointed it at a lookalike repository and injected malicious files through the maturin build configuration before the official tag was created.

The payload consisted of two components. A credential stealer named privcollect collected AWS, GCP, Azure, SSH, and browser data, then exfiltrated it to www.litellm.dev/healthcheck. A remote access trojan checked a GitHub repository hourly for new commands. The malicious code ran on any Python interpreter start without requiring an explicit import of LiteLLM.

PyPI wheels were live between 11:39 and 13:23 UTC on October 21. Docker tags v1.107.0, latest, main-latest, and main-stable pointed to the compromised image between 11:46 and 14:20 UTC. Official source code for the v1.107.0 tag remained clean; the malicious content entered only during the automated build step.

Scope of Exposure and Reported Activity

LiteLLM records approximately 23 million weekly downloads. Security researchers observed 49,000 downloads of the malicious wheels. Stolen credentials appeared in use shortly after exfiltration, including AWS Bedrock access. The attack marks the second supply-chain incident for the project in 2026; a March release had been compromised through a Trivy-related vector.

Enterprise customers using private registries remained unaffected. Floating Docker tags increased exposure because many pipelines pull latest or main-latest without pinning. No CVE was assigned because the issue involved a malicious release rather than a code vulnerability.

Official guidance states that all prior versions before 1.107.0 are safe. The company paused new releases and revoked the compromised tokens while the investigation continues. Users who installed the affected version or pulled the tainted images should treat their environments as compromised.

Immediate Remediation Steps

Teams should pin LiteLLM to version 1.106.2 or an earlier clean release and rebuild virtual environments and container images from scratch. Floating tags must be replaced with digest pins where possible. Existing installations require manual removal of cook.pth, cook.py, and sitecustomize.py files along with any cached bytecode.

Rotate every credential reachable from the affected environment: cloud IAM roles, LLM provider keys stored in LiteLLM proxy databases, database passwords, and environment secrets. Enable monitoring for unusual activity such as new CloudTrail events or unexpected API calls. Avoid running pip or uninstall commands in a potentially infected environment until the cleanup scripts have been removed.

Organizations should watch the official LiteLLM incident post and GitHub issue 47826 for further updates on token rotation and additional hardening measures.