LiteLLM 1.107.0 release pipeline compromise
Summary
On October 21, 2026, LiteLLM, the open source gateway that routes requests to hosted language model providers, disclosed that version 1.107.0 published to PyPI, Docker Hub, and GHCR carried a credential stealer and a remote code loader. LiteLLM said the packages were live for roughly two hours before removal. The project told users to assume exfiltration on any affected host. Its investigation into the initial access is ongoing.
What happened
- LiteLLM stated that the malicious PyPI release was available from 11:39 to about 13:23 UTC, and that several Docker and GHCR tags pointed to compromised images until as late as 14:20 UTC.
- The project said an attacker used developer credentials to push a workflow change that built the release from a lookalike repository,
Berri-AI/litellm. - Datadog Security Labs reported that the package added startup files that run whenever Python launches, even if LiteLLM is never imported.
- Datadog said the stealer targeted cloud, developer, AI tool, browser, and LiteLLM proxy credentials, and sent encrypted results to a lookalike domain. It observed no second-stage payload.
Timeline
- 2026-10-21 - Version 1.107.0 appears on PyPI at 11:39 UTC and in container registries shortly after.
- 2026-10-21 - LiteLLM restores its release workflow and removes or repoints the affected artifacts.
- 2026-10-21 - LiteLLM publishes its incident notice.
- 2026-10-23 - LiteLLM updates the notice and states that some earlier assumptions were inaccurate or incomplete.
What the vendor has confirmed
LiteLLM said it revoked maintainer credentials, reduced release permissions, and restored the workflow. It named 1.106.2 as a safe pin. It told operators to rotate provider keys stored in the proxy database, master and virtual keys, database passwords, and cloud role credentials. Customers on its private enterprise registry were not affected, according to the notice.
What remains unclear
- The number of hosts that installed the affected release has not been disclosed.
- LiteLLM said it suspects the developer tokens were taken from logs on an internet-exposed internal deployment, but has not confirmed how that system was accessed.
- Whether any collected credentials were used downstream has not been reported.
Broader context
This is the second publicly documented compromise of the same gateway package in 2026. Datadog said no link between the two has been established. In both cases the release pipeline, not the gateway code, was where a package holding many provider keys was turned against its users.
Sources
- LiteLLM security incident notice, October 21, 2026 (vendor-disclosure)
- Datadog Security Labs analysis of the compromised release (research)
- Wiz analysis of the LiteLLM compromise (research)
- TechCrunch coverage (press)
