LiteLLM 1.107.0 PyPI/Docker supply-chain compromise
› LiteLLM (PyPI + official Docker/GHCR images)
- started
- Oct 21, 2026
- closed
- ongoing
- CVEs
- 1
- sources
- 8
## summary
On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.
severity: Critical supply-chain (credential theft + RAT); OSV MAL-2026-2144 / PYSEC-2026-2
## cve ids[1]
## affected
- litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window
## fixed in
- 1.106.2 (last known safe); malicious 1.107.0 pulled
## timeline[4]
Malicious 1.107.0 wheels appear on PyPI.
PyPI quarantines/pulls the package (~2h window).
Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.
LiteLLM posts containment update; investigation ongoing.
## advisories[1]
## news & write-ups[3]
## posts[4]
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools. t.co/4Mbt1LbhLu
🚨 LiteLLM 1.107.0 compromised in a supply chain attack. Malicious PyPI packages and Docker images delivered a credential stealer and backdoor. ⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials. 🔗 Full story: t.co/ANqBuYaGx5
❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware! TLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP. The malware combines two threats in one t.co/WjpMeKcVgg
‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release Details: t.co/8rlH8xijjj LiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed t.co/caDoffOmFx
## notes & caveats
Package pulled but any host that installed 1.107.0 during the window should still be treated as compromised (credential rotation required). MAL-2026-2144 is an OSV malware ID, not a classic CVE. lifecycle live until LiteLLM closes the investigation.
