LiteLLM removes poisoned 1.107.0 packages after release pipeline breach
LiteLLM has disclosed that attackers compromised its release pipeline on October 21, 2026 and published malicious LiteLLM version 1.107.0 to PyPI, Docker Hub and GitHub Container Registry. The poisoned release contained a credential stealer and a backdoor capable of fetching and running remote code.
Users are affected if they installed an unpinned LiteLLM package through pip between 11:39 a.m. and 1:23 p.m. UTC, or used the v1.107.0, latest, main-latest or main-stable Docker and GHCR tags between 11:46 a.m. and 2:20 p.m. UTC. LiteLLM said the compromise occurred at about 4:00 a.m. PST.
Two persistence paths in the malicious package
The malicious package used a cook.pth path file to import cook.py. That script deobfuscated itself and launched a routine named privcollect, designed to collect system, browser, developer, cloud and AI-tool credentials and keys. The data was sent by HTTP POST to litellm[.]dev/healthcheck.
A second mechanism relied on sitecustomize.py, which executes on Linux and macOS. It was configured to retrieve domain.txt from a GitHub repository, then download a Python payload from a current command-and-control domain at /codepy. The loader created a background daemon, used a lock file at /tmp/remote_code_loader.lock, and attempted the process every hour.
Wiz said this simultaneous use of .pth files and sitecustomize.py appears to be the first documented case of the technique in the wild. The GitHub-hosted text file contained only initial test values before GitHub removed the repository at roughly 1:30 p.m. UTC.
Stolen credentials used against cloud environments
Wiz observed use of stolen credentials beginning about 4.5 hours after exfiltration. The attacker validated AWS instance-role credentials taken from compromised CI runners and Kubernetes nodes from 168.100.8[.]57 and 165.227.201[.]8 between 4:20 p.m. and 5:01 p.m. UTC.
The validation sequence included sts:GetCallerIdentity, bedrock:ListFoundationModels and a ListModels request, which Wiz described as consistent with LLMjacking. In a small number of environments, the attacker also enumerated IAM roles, users and access keys, alongside account and CloudTrail discovery requests.
Release controls were bypassed with GitHub CLI tokens
LiteLLM had moved releases to a private repository, made Docker tags immutable and signed Docker images after an incident in March. But it temporarily granted two internal engineers expanded release permissions for daily customer bugfix backports on October 19.
The attacker had three sets of developer GitHub CLI credentials, including one able to run GitHub workflows. LiteLLM said a GitHub organization owner token was used to disable branch protections and force-push malicious changes. The attacker then ran the compromised workflow against the lookalike repository Berri-AI/litellm rather than BerriAI/litellm, causing signed malicious artifacts to be published.
LiteLLM identified cases in which Claude Code could include a user's GitHub CLI OAuth token in a response body. If that body was logged, the token could appear in LiteLLM logs. The project also found an unexpectedly named account in a publicly exposed internal LiteLLM deployment and suspects the attacker accessed those logs there, although the route by which the deployment became public remains unclear.
Actions for affected teams
LiteLLM advises teams to remove version 1.107.0, isolate hosts where it was installed, search for the malicious Python artifacts, block the exfiltration domain, rotate credentials and investigate execution of /codepy. For businesses, the immediate implication is to treat any affected installation as a potential credential exposure, rebuild impacted workloads and verify the exact wheel or image digest before software reaches production.