LiteLLM 1.107.0 shipped with a credential stealer — check your AI stack now
23 October 2026
The popular LLM gateway's 1.107.0 release on PyPI and Docker was built from a lookalike GitHub repo and carried a payload that runs on every Python start, harvesting cloud keys, SSH keys, browser passwords and AI provider API keys. The bad release was live for roughly three hours on 21 Oct before being pulled.
Incident status
- Active
- Contained
- Patch out
- Resolved
What to do
- Don't run pip first in a suspect environment: Python startup re-runs the payload. Look for litellm-1.107.0.dist-info, cook.pth, cook.py or sitecustomize.py in site-packages
- Pin litellm==1.106.2 and rebuild virtualenvs and containers from a clean image rather than cleaning in place
- Treat affected hosts as compromised: rotate cloud roles, SSH, CI, database passwords and every LLM provider key the proxy held
- Block litellm.dev and search network logs for requests to it
Timeline
- 23 October 2026BerriAI's incident write-up says the attacker used stolen GitHub CLI tokens from three developers, likely pulled from logs on an exposed internal deployment, to override release protections. How that deployment was first accessed is not yet confirmed.
- 22 October 2026PyPI release removed and infected Docker images pulled; BerriAI still investigating how its release pipeline pointed at the lookalike repo.
- 21 October 2026Malicious 1.107.0 published to PyPI and Docker; reported on GitHub within about 30 minutes.
Based on reporting by LiteLLM. Read their full coverage for details.