Attackers Compromise LiteLLM Release Pipeline to Publish Credential-Stealing Package
Summary
Attackers compromised LiteLLM’s release pipeline and published version 1.107.0 with credential-stealing and remote-code execution capabilities. Wiz reported subsequent abuse of stolen AWS credentials; the initial access route remains unclear.
Key points
- On October 21, 2026, attackers used compromised release credentials to publish LiteLLM 1.107.0 to PyPI and Docker Hub.
- The package targeted users who installed an unpinned version during the stated window; Docker users of specified 1.107.0 and latest-related tags were also potentially affected.
- Malicious Python files collected system, browser, developer, cloud, and AI tool secrets and sent data to litellm[.]dev/healthcheck.
- A backdoor could periodically fetch and execute a Python payload using a GitHub-hosted domain file; the relevant GitHub content was removed.
- Wiz reported that attackers later validated stolen AWS credentials and performed activity consistent with LLMjacking, along with some IAM enumeration and discovery.
- LiteLLM suspects publicly exposed deployment logs may have exposed GitHub CLI OAuth tokens, but the initial access route has not been established.
- LiteLLM says it hardened its release process. Developers are advised to remove version 1.107.0, isolate affected hosts, investigate for malicious artifacts, rotate credentials, and rebuild.
Article Details
- Victim Organization
- LiteLLM
- Incident Type
- Compromise of LiteLLM's release pipeline to publish a malicious Python package and Docker image containing a credential stealer and backdoor.
- Incident Date
- 2026-10-21
- Data Types Exposed
- System secrets
- Browser secrets
- Developer credentials
- Cloud credentials
- AI tool secrets
- GitHub CLI OAuth tokens
- Operational Impact
- LiteLLM 1.107.0 was published to PyPI and Docker Hub. Users who installed the unpinned package or used specified Docker tags during the affected windows were impacted. The malware was designed to collect credentials and keys, exfiltrate them, and execute remote code. Wiz reported subsequent validation and use of stolen AWS credentials.
- Claim Status
- confirmed
People
Benjamin ReadWiz researcher who commented on the malware's use of .pth files and sitecustomize.py.Guy KorolevskiJFrog security researcher quoted on risks from installing compromised software artifacts.Ilyas MakariAikido researcher quoted describing the malware's background daemon and hourly C2 and payload retrieval.Rami McCarthyWiz researcher who commented on the malware's use of .pth files and sitecustomize.py.
Products
DockerOn October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m. PST. The followingLiteLLMLiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor.