Story ·

LiteLLM 1.107.0: a trusted AI library shipped a password stealer

LiteLLM is an open-source tool developers use to talk to many AI services through one interface. On 21 October, attackers got a poisoned version, 1.107.0, published on PyPI and Docker. LiteLLM says it steals passwords and keys and can run code on the machine. Here is what it says, how to check, and what to do.

By Threat Atlas India · Published 22 October 2026 · Facts from LiteLLM’s update of 9:30 pm IST, 21 October

The short version

  • What happened: a malicious release, litellm 1.107.0, was published on PyPI and as Docker images. LiteLLM says it “steals credentials and loads remote-code execution tools”.
  • How long: on PyPI, from 5:09 pm to about 6:53 pm IST on 21 October. The container images were up a little longer.
  • Who is affected: anyone who installed 1.107.0 without pinning a version, or ran the affected Docker tags, in that window. LiteLLM says customers on its private enterprise registry are not.
  • The safe version: 1.106.2, the last release before the incident. Socket notes it does not certify older releases as clean.
  • If it ran: treat every secret on that machine as stolen and rotate it.

First, why this one matters

An AI app usually needs keys for several AI providers. LiteLLM sits in the middle: the app talks to LiteLLM, and LiteLLM talks to OpenAI, Anthropic and others. So it often runs on machines that hold exactly the keys an attacker wants. The Register puts its downloads at about 23 million a week.

You installAn update of a library you trust
The library runsWith access to your keys. This is where the stealer sits.
Your secretsCloud, AI and code-host keys

How it unfolded

  1. The attack begins. By LiteLLM’s account, one engineer’s GitHub account overrides the branch protections and changes the release workflow.
  2. The approval gate. A second engineer’s account passes the production approval step. A third is used to delete workflow records, which limited what investigators can see.
  3. Published. Seven malicious wheels (the packaged builds) of 1.107.0 go up on PyPI. The container images follow at 5:16 pm.
  4. Pulled from PyPI. Docker Hub and GitHub tags are repointed or removed between about 7:20 and 7:50 pm.
  5. LiteLLM’s update. It says the incident is contained and the investigation continues, with the next update planned for midnight IST.

LiteLLM says the official source tag on GitHub does not contain the malicious files. The poisoned builds were made from a look-alike repository, Berri-AI/litellm, one hyphen away from the real BerriAI/litellm.

What the malware does

It runs without being asked

One malicious file, cook.pth, runs every time Python starts, whether or not LiteLLM is used. Per Socket, running Python or pip in an affected environment can trigger it again.

It steals broadly

Per Socket’s analysis: cloud and deployment keys (AWS, Azure, Google Cloud, Kubernetes, GitHub), developer secrets (.env files, SSH keys), AI tools’ login files, browser logins, and, where it can, the keys LiteLLM itself stores. The data is encrypted and sent to an attacker’s domain.

It leaves a door open

A second file starts a background process that checks an attacker-controlled location about every hour and can download and run more code. Socket says that pointer was returning nothing by 6:31 pm IST, which stopped that stage, but the stealer is separate.

Did it run on your machine?

LiteLLM and Socket list these signs. A missing sign does not prove you are clean.

  • Files: cook.pth, cook.py or sitecustomize.py in the Python packages folder, or litellm-1.107.0.dist-info.
  • Background process: a Python process holding /tmp/remote_code_loader.lock.
  • Marker file: /tmp/.pc_once_*, which Aikido says shows the theft already ran.
  • Network logs: requests to www.litellm.dev/healthcheck from your servers.
  • Containers: a running image whose digest starts sha256:1bbcb1443bc9.

What to do

If you use LiteLLM

  1. Check your version. If you pinned an earlier one, you were not hit by this release. If you did not pin, find out what you installed during the window.
  2. Do not install or run anything first in a suspect environment. LiteLLM warns that running pip install there re-triggers the malware.
  3. Isolate, then rebuild from scratch. Delete the files, stop the background process, and rebuild images and virtual environments. Pin to 1.106.2.
  4. Rotate everything the machine could reach, from a clean computer: cloud keys, AI provider keys, LiteLLM’s master and virtual keys, the database password and any secrets in the environment.
  5. Check what the old keys did. On AWS, LiteLLM suggests looking in CloudTrail for GetCallerIdentity calls from your instance around install time.

If you only use apps that use LiteLLM

  1. Nothing to install. It is up to the app’s owner. If a service you use tells you to change a password, do it.

What we don’t know yet

  • How the attackers got the tokens. LiteLLM says it has not identified the mechanism, and that it appears to involve stolen GitHub CLI tokens.
  • Whether the attackers still have access. LiteLLM says it “cannot yet assert that there is no further access” to those accounts.
  • How many installs there were. No one has published a count.
  • Who is behind it. Nobody has named a group.
  • Whether a given deployment’s saved keys were actually read. Socket says the code tries to read them but does not prove it succeeded anywhere.

Sources

More stories

Supply chain · 21 October 2026The key was 4: what the eMudhra certificate failure means for IndiaEight certificate keys of Indian certificate authority eMudhra were so weak that one was the number 4. What happened, who was exposed, and our check of 108 Indian bank, insurer, market, payment and government websites.
Breaches · 22 October 2026Amagi Media Labs: an extortion claim, what is confirmed and what is only claimedBengaluru media-technology company Amagi told the stock exchanges that a threat actor is trying to extort it over stolen network data. What Amagi confirmed, what a ransomware group lists, and what is still unknown.
Vulnerabilities · 22 October 2026Patch week: GitLab, Node.js, Java and Plex, one by oneFour updates to check this week: a second CVSS 10 flaw in GitLab, Node.js and Java releases that both block the eMudhra certificates, and Plex flaws now being attacked. What each is, and what to update to.
All stories →