LiteLLM 1.107.0 release hijacked in supply-chain attack that stole credentials and loaded a backdoor

On 21 October 2026, LiteLLM — a widely used open-source Python proxy that gives applications a single, OpenAI-compatible interface to more than a hundred large language model providers — disclosed that attackers had hijacked its release pipeline to publish a malicious version 1.107.0 to the Python Package Index and to public Docker registries. The tampered build shipped a credential stealer and a remote-code-execution backdoor inside the official package, making it the project's second supply-chain compromise of 2026 after a separate incident in March.

The malicious wheels were live on PyPI for roughly two hours, from 11:39 to 13:23 UTC, and the project said all seven wheels published for that version were affected, spanning macOS, Linux and Windows builds. Compromised container tags — including v1.107.0, latest, main-latest and main-stable on Docker Hub and GitHub Container Registry — were active from 11:46 until they were removed or repointed to clean artifacts by 14:20 UTC. The official v1.107.0 source tag on GitHub was clean; LiteLLM said the poisoned artifacts had been built from an attacker-controlled repository, so reviewing the source would not have revealed the tampering. Maintainers urged users to pin back to 1.106.2 or another version published before the incident.

How the attackers got in

LiteLLM's director of security, Oliver Jensen, said the malicious actions were carried out through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. According to the project's incident report, one organisation-owner token was used to disable branch protections and force-push a change to the private release workflow, a second credential satisfied the production approval gate, and a third later deleted workflow records in an apparent attempt to cover the tracks. The company believes the tokens were pulled from the logs of an internal deployment that had been exposed to the public internet, though it said it had not yet confirmed the original attack vector and "cannot yet assert that no further access" to the accounts had occurred. LiteLLM revoked every token involved, cut its registries' trusted publishing links, and removed all but one unaffected user from its GitHub organisation.

The payload

Researchers at SafeDep, Socket, StepSecurity and Upwind analysed the build. The first-stage payload — which StepSecurity dubbed "privcollect" — was wired to run at Python interpreter startup through a cook.pth path file containing import cook, meaning it executed even when an application never imported LiteLLM. It harvested cloud tokens, developer account credentials, private keys, AI-tool credential files, Chromium and Firefox browser data, environment variables and LiteLLM proxy secrets, then packed them into a compressed archive and exfiltrated them over HTTP. A second-stage backdoor forked a background daemon that polled a GitHub "dead drop" roughly every hour and executed whatever Python the attacker served. JFrog noted that it found no evidence linking this campaign to the March TeamPCP compromise, so the two should be treated as separate incidents.

LiteLLM said private enterprise releases were not affected and that the incident was contained with the investigation ongoing. Because the malicious .pth file reloads on any Python start, the project warned that simply reinstalling is unsafe: operators should remove the indicator files, kill the daemon, rebuild affected environments and container images from scratch, and rotate every credential the compromised hosts could reach from a clean machine.