LiteLLM 1.107.0 Supply-Chain Attack Steals Credentials Through PyPI and Docker

Oct 22, 2026 · Original article ↗

Summary

Attackers published trojanized LiteLLM 1.107.0 packages and Docker images, apparently using stolen maintainer tokens. The payload stole credentials and enabled follow-on AWS reconnaissance; artifacts were removed, and users are advised to rebuild affected hosts and

Key points

Trojanized LiteLLM 1.107.0 wheels and Docker images were available on October 21, 2026, before the artifacts were removed.
The payload used Python startup hooks, so starting a Python interpreter could trigger it even without importing LiteLLM.
A 16-module stealer collected cloud, Kubernetes, SSH, AI-tool and browser secrets, as well as LiteLLM proxy credentials.
A second component on Linux and macOS polled GitHub hourly for remote code; the article says it appeared dormant.
Attackers apparently used GitHub CLI OAuth tokens from three engineers; the suspected token-leak path is unconfirmed, and no actor has been publicly attributed.
Wiz observed use of stolen AWS instance-role credentials followed by Bedrock and IAM enumeration, a pattern described as consistent with LLMjacking.
The article recommends rebuilding affected environments from clean artifacts, rotating exposed credentials, and pinning LiteLLM to 1.106.2 or another pre-incident release.

Article Details

Attack Vectors: Attackers used what appear to be stolen GitHub CLI OAuth tokens from three LiteLLM engineers to modify and approve the release workflow and publish trojanized LiteLLM 1.107.0 packages and Docker images.
The affected Python wheels installed cook.pth, cook.py, and sitecustomize.py startup hooks that ran the payload whenever a Python interpreter started, without requiring an application to import LiteLLM.
A 16-module stealer collected cloud, Kubernetes, SSH, AI tool, browser, and LiteLLM proxy credentials, encrypted them, and sent them to a lookalike domain.
On Linux and macOS, a second component polled GitHub hourly for remote code.
Wiz observed the attacker validate stolen AWS instance role credentials, list Amazon Bedrock models, and enumerate IAM; the article describes this as a pattern consistent with LLMjacking.
Defensive Notes: Assume a host is compromised if it ran litellm==1.107.0 or an affected image; a missing marker file does not establish that the host is clean.
Inspect hosts with trusted tooling rather than running pip in an affected environment, because starting Python can retrigger the payload. Remove payload files manually, stop the detached daemon, and rebuild environments and images from scratch.
Block litellm==1.107.0 and affected image tags or digests. Pin litellm==1.106.2 or another release published before October 21, 2026, and pin image digests rather than floating tags.
Rotate exposed cloud and instance-role credentials, provider keys, LiteLLM proxy keys, database credentials, SSH keys, registry tokens, and AI tool sessions from a clean machine.
Search egress logs for the reported exfiltration endpoint and GitHub domain.txt requests; review CloudTrail for unfamiliar GetCallerIdentity, Bedrock, and IAM enumeration activity.
Quarantine affected hosts and containers, preserve evidence, rebuild from reviewed artifacts, and restrict release-workflow permissions and branch-protection overrides.

Indicators of compromise

Type	Indicator	Context
IPV4	`165[.]227[.]201[.]8`	Source IP identified by Wiz as attacker infrastructure.
IPV4	`168[.]100[.]8[.]57`	Source IP identified by Wiz as attacker infrastructure.
SHA256	`34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa`	SHA-256 hash of the malicious sitecustomize.py payload file.
SHA256	`7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb`	SHA-256 hash of the malicious cook.pth payload file.
SHA256	`9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25`	SHA-256 hash of the malicious cook.py payload file.
URL	`hxxp[:]//www[.]litellm[.]dev/healthcheck`	Reported exfiltration endpoint used by the credential stealer.