{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:53:33.742Z",
  "tag": {
    "id": "pypi",
    "label": "PyPI",
    "isStack": true,
    "url": "https://pwn.watch/t/pypi",
    "feed": "https://pwn.watch/t/pypi/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 1,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "litellm-1-107-0-pypi-compromise",
      "title": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise",
      "json": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "LiteLLM (PyPI + official Docker/GHCR images)",
      "tags": [
        "python",
        "pypi",
        "docker",
        "ai",
        "litellm",
        "supply-chain"
      ],
      "cveIds": [
        "MAL-2026-2144"
      ],
      "affectedVersions": [
        "litellm==1.107.0; Docker/GHCR tags v1.107.0, latest, main-latest, main-stable during the Oct 21 window"
      ],
      "fixedVersions": [
        "1.106.2 (pin; last known safe). Malicious 1.107.0 removed from PyPI, Docker Hub and GHCR"
      ],
      "startedAt": "2026-10-21",
      "closedAt": null,
      "updatedAt": "2026-10-22T16:00:44+02:00",
      "summary": "On Oct 21 2026 attackers compromised LiteLLM’s release pipeline and published malicious litellm==1.107.0 to PyPI (live ~2 hours) plus compromised Docker Hub/GHCR tags (v1.107.0, latest, main-latest, main-stable). The wheels install cook.pth / cook.py / sitecustomize.py that steal cloud, developer and AI-tool credentials at every Python startup and open a remote-code loader. Second LiteLLM compromise of 2026.",
      "xPost": null
    },
    {
      "slug": "ultralytics-pypi-supply-chain-attack",
      "title": "Ultralytics PyPI releases backdoored with a crypto miner",
      "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack",
      "json": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ultralytics (PyPI)",
      "tags": [
        "python",
        "pypi",
        "github-actions",
        "ai",
        "ultralytics",
        "supply-chain",
        "cryptominer",
        "github"
      ],
      "cveIds": [],
      "affectedVersions": [
        "8.3.41",
        "8.3.42",
        "8.3.45",
        "8.3.46"
      ],
      "fixedVersions": [
        "Malicious versions removed from PyPI; see vendor advisory for the clean release"
      ],
      "startedAt": "2024-12-04",
      "closedAt": "2024-12-11",
      "updatedAt": "2024-12-11",
      "summary": "Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.",
      "xPost": null
    },
    {
      "slug": "pypi-pauses-registrations-malware-flood-2023",
      "title": "PyPI pauses new users and projects amid a flood of malware",
      "url": "https://pwn.watch/i/pypi-pauses-registrations-malware-flood-2023",
      "json": "https://pwn.watch/i/pypi-pauses-registrations-malware-flood-2023.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "no-fix-needed",
      "product": "PyPI",
      "tags": [
        "pypi",
        "malware",
        "registry-abuse"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-05-20",
      "closedAt": "2023-05-21",
      "updatedAt": "2023-05-21",
      "summary": "PyPI temporarily stopped new user registrations and new project names for about a day because malicious users and packages outpaced what its small admin team could handle.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Help Net Security",
      "handle": "helpnetsecurity",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1602979161932455937/3RwfWo0d_bigger.jpg",
      "text": "LiteLLM hit by second supply chain attack this year, users urged to rotate credentials - https://t.co/7iolIMAKe8 - @GossiTheDog @RockHudsonRock @cloudsek @wiz_io @AikidoSecurity @SocketSecurity - #LiteLLM #SupplyChainAttack #OpenSource #malware #Cybersecurity #CyberSecurityNews https://t.co/ZLPywonXYC",
      "date": "2026-10-22T13:26:50.000Z",
      "url": "https://x.com/helpnetsecurity/status/2113260794544796098",
      "media": [],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🚨 LiteLLM 1.107.0 compromised in a supply chain attack.\n\nMalicious PyPI packages and Docker images delivered a credential stealer and backdoor.\n\n⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials.\n\n🔗 Full story: https://t.co/ANqBuYaGx5",
      "date": "2026-10-21T18:02:10.000Z",
      "url": "https://x.com/TheHackersNews/status/2112967698103894257",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVLE6tcakAATDtC.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Moshe Siman Tov Bustan",
      "handle": "MosheTov",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1998067906706345984/SwYIhsPZ_bigger.jpg",
      "text": "❗ If 2 PHP vulns weren't enough for one day (or, 0-day?) - LiteLLM were compromised today by a combined RAT Infostealer malware!\n\nTLDR - LiteLLM PyPI ver 1.107.0 is compromised, if you installed it - revoke keys and change passwords ASAP.\n\nThe malware combines two threats in one https://t.co/WjpMeKcVgg",
      "date": "2026-10-21T15:46:21.000Z",
      "url": "https://x.com/MosheTov/status/2112933514962247891",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKl1H6XQAAPSJw.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Cyber Security News",
      "handle": "The_Cyber_News",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1174924326807592960/aJMuU6Ms_bigger.jpg",
      "text": "‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release\n\nDetails: https://t.co/8rlH8xijjj\n\nLiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed https://t.co/caDoffOmFx",
      "date": "2026-10-21T15:21:29.000Z",
      "url": "https://x.com/The_Cyber_News/status/2112927256956088756",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKf10bawAAfyb6.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    },
    {
      "authorName": "Socket",
      "handle": "SocketSecurity",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2057141188591824896/aKdKFNEE_bigger.jpg",
      "text": "🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised.\n\nVersion 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools. https://t.co/4Mbt1LbhLu",
      "date": "2026-10-21T14:03:54.000Z",
      "url": "https://x.com/SocketSecurity/status/2112907732877775016",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HVKNz_RWYAAoI1O.jpg"
        }
      ],
      "incident": "litellm-1-107-0-pypi-compromise"
    }
  ],
  "changes": [
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "LiteLLM root cause: attacker held three developer GitHub CLI tokens, likely scraped from logs of an internet-exposed internal LiteLLM deployment (Claude Code can echo a gh OAuth token into logged response bodies), disabled branch protection and ran the release workflow against lookalike repo Berri-AI/litellm.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "StepSecurity full teardown: payload exfiltrates to lookalike www.litellm.dev (registered Oct 13) and an hourly loader polls a GitHub dead drop (letters9813/pythonclient-test, now deleted). Infected hosts keep polling, so anyone re-registering that username could run code on them: kill the process holding /tmp/remote_code_loader.lock, delete cook.pth/cook.py/sitecustomize.py, pin 1.106.2 and rotate everything.",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious 1.107.0 wheels appear on PyPI.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T11:39Z",
      "title": "Malicious litellm==1.107.0 (all seven wheels) live on PyPI 11:39-13:23 UTC; Docker tags v1.107.0/latest/main-latest/main-stable compromised 11:46-14:20 UTC.",
      "body": null,
      "sourceUrl": "https://docs.litellm.ai/blog/security-incident-oct-21-2026",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T13:23Z",
      "title": "PyPI quarantines/pulls the package (~2h window).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T14:20Z",
      "title": "Docker Hub tags cleaned / retargeted; GHCR images made unavailable earlier.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T16:20Z",
      "title": "Wiz sees stolen AWS instance-role credentials validated from 168.100.8.57 and 165.227.201.8 (sts:GetCallerIdentity, then Bedrock model listing), consistent with LLMjacking.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21T20:30Z",
      "title": "LiteLLM posts containment update; investigation ongoing.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "litellm-1-107-0-pypi-compromise",
      "incidentTitle": "LiteLLM 1.107.0 PyPI/Docker supply-chain compromise",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-19",
      "title": "LiteLLM temporarily expands release permissions for two internal engineers (daily bugfix backports).",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html",
      "url": "https://pwn.watch/i/litellm-1-107-0-pypi-compromise"
    },
    {
      "incident": "ultralytics-pypi-supply-chain-attack",
      "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-11",
      "title": "PyPI publishes its analysis: 8.3.41, 8.3.42, 8.3.45 and 8.3.46 affected and removed",
      "body": null,
      "sourceUrl": "https://blog.pypi.org/posts/2024-12-11-ultralytics-attack-analysis/",
      "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack"
    },
    {
      "incident": "ultralytics-pypi-supply-chain-attack",
      "incidentTitle": "Ultralytics PyPI releases backdoored with a crypto miner",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-05",
      "title": "Issue #18027: published 8.3.41 wheel differs from GitHub and runs an XMRig miner",
      "body": null,
      "sourceUrl": "https://github.com/ultralytics/ultralytics/issues/18027",
      "url": "https://pwn.watch/i/ultralytics-pypi-supply-chain-attack"
    },
    {
      "incident": "pypi-pauses-registrations-malware-flood-2023",
      "incidentTitle": "PyPI pauses new users and projects amid a flood of malware",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-05-21",
      "title": "Registrations resume",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/pypi-temporarily-pauses-new-users-projects-amid-high-volume-of-malware/",
      "url": "https://pwn.watch/i/pypi-pauses-registrations-malware-flood-2023"
    },
    {
      "incident": "pypi-pauses-registrations-malware-flood-2023",
      "incidentTitle": "PyPI pauses new users and projects amid a flood of malware",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-05-20",
      "title": "PyPI suspends new user and new project registration",
      "body": null,
      "sourceUrl": "https://status.python.org/incidents/0th66lc1l8by",
      "url": "https://pwn.watch/i/pypi-pauses-registrations-malware-flood-2023"
    }
  ]
}