LiteLLM supply chain attack distributes malware stealing credentials and remote access trojan

Unknown attackers compromised LiteLLM version 1.107.0 on October 21, 2026, distributing credential-stealing malware and a remote access trojan via PyPI and Docker registries. LiteLLM security director Oliver Jensen reported that the breach occurred using stolen GitHub CLI OAuth tokens across three engineers' accounts. Security researchers from Aikido, Wiz, and Socket advised affected organizations to halt deployments, inspect system locks, and revoke exposed credentials.

LiteLLM 1.107.0 supply chain compromise

• ▪PyPI quarantined LiteLLM version 1.107.0 within hours of publication, and Docker images were removed from Docker Hub and GitHub Container Registry.
• ▪Unknown attackers compromised the LiteLLM open-source AI gateway release process on October 21, 2026, distributing malicious version 1.107.0 through PyPI and Docker registries.
• ▪LiteLLM version 1.106.2 is the latest safe release following the October 21, 2026 supply chain compromise.
• ▪LiteLLM, developed by BerriAI, provides a shared interface for LLM providers including OpenAI, Anthropic, and Google Gemini, receiving approximately 23 million weekly downloads.

Stolen GitHub OAuth tokens

• ▪LiteLLM revoked all compromised OAuth tokens and temporarily removed all but one unaffected user from its GitHub organization to mitigate unauthorized access.
• ▪Attackers injected three malicious files into the LiteLLM release pipeline using commits to a hyphenated GitHub organization variant, github.com/Berri-AI/litellm.
• ▪Attackers used one compromised engineer's account to trigger the project-releaser run and another user's account to approve the malicious LiteLLM release on October 21, 2026.
• ▪LiteLLM security director Oliver Jensen stated that the October 21, 2026 compromise occurred through three engineers' GitHub accounts using stolen GitHub CLI OAuth tokens.

Credential stealer malware payload

• ▪The LiteLLM credential stealer targets API keys for OpenAI, Anthropic, and Cohere, along with proxy saved credentials and model configurations.
• ▪Stolen data from LiteLLM version 1.107.0 is encrypted with AES-256-CBC, wrapped with RSA-4096, and sent via HTTP POST to litellm.dev/healthcheck.
• ▪The LiteLLM credential stealer harvests AWS credentials, GCP service account keys, Azure tokens, environment variables, browser data, and SSH private keys.
• ▪Malicious LiteLLM version 1.107.0 executes a credential stealer called privcollect via a cook.pth file that automatically runs cook.py whenever Python starts.

Remote access trojan backdoor

• ▪Malicious LiteLLM version 1.107.0 installs a remote access trojan via sitecustomize.py that executes at Python startup to run arbitrary code.
• ▪The LiteLLM remote access trojan spawns a background daemon that polls attacker infrastructure every hour for commands or checks a GitHub dead drop repository.

Threat hunting mitigation guidance

• ▪Security firms Aikido, Wiz, Socket, and StepSecurity released threat-hunting instructions advising teams using LiteLLM 1.107.0 to stop deployment and investigate Python environments.
• ▪Aikido Security malware hunter Ilyas Makari advised users to check for /tmp/.pc_once_* to confirm data exfiltration and /tmp/remote_code_loader.lock to detect C2 daemon execution.

Previous LiteLLM compromise incidents

• ▪CloudSEK reported that a previous LiteLLM compromise in March 2026 potentially exposed over 2,500 organizations and 434,000 CI/CD pipelines worldwide.
• ▪The path file execution technique using cook.pth in LiteLLM version 1.107.0 was previously observed during TeamPCP supply chain attacks in March 2026.