A poisoned release of LiteLLM, a widely used open-source gateway for calling AI models, was published to PyPI and as container images on October 21. Version 1.107.0 was built to steal cloud, developer and AI-tool credentials, and attackers were later seen testing stolen AWS keys. Anyone who installed it needs to rotate secrets, not just upgrade.
What happened
On October 21, 2026, seven malicious wheels of litellm 1.107.0 appeared on PyPI, according to security firm Socket, with the first published at about 11:39 UTC. Container images tagged v1.107.0, latest, main-latest and main-stable also served the bad build. Help Net Security reports the PyPI package was live from 11:39 to 13:23 UTC and the images from 11:46 to 14:20 UTC. Socket’s scanner flagged the release about seven minutes after publication.
The payload sits in Python startup files, including a cook.pth file, so it runs every time Python starts in an affected environment, even if LiteLLM is never imported. Socket says it launches a background loader that fetches more Python code from a location named in a GitHub file. That file was empty when Socket checked, but it could be changed later. Removing the package does not delete these files.
Socket describes 16 collection modules targeting cloud credentials (AWS, Azure, Google Cloud, Kubernetes), SSH and GPG keys, .env files, browser data, shell history, and auth files for AI tools including Codex, Claude, Gemini and Cursor. Stolen data is encrypted and sent to a "healthcheck" path on a litellm.dev look-alike domain. Per Help Net Security, the attacker began testing stolen AWS credentials about four and a half hours after exfiltration, including checks of access to Amazon Bedrock models.
LiteLLM says the release pipeline was compromised, the affected releases have been pulled, and enterprise customers on its private registry were not affected. Reporting cited by Help Net Security says the attacker used GitHub accounts of three LiteLLM engineers, apparently through stolen GitHub CLI tokens. The project says it is still investigating and rotating its own tokens.
Who is affected
Socket puts LiteLLM at roughly 23 million weekly downloads, so the pool of potential installs is large, but the exposure window was only a few hours. You are at risk if any build, CI job, developer laptop or container pulled litellm 1.107.0 or one of the floating image tags during those windows. Teams that pinned an earlier version or image digest should not be affected. This is also the second LiteLLM supply-chain incident this year, per Help Net Security.
What to do
The steps below combine vendor and researcher guidance with our own analysis.
- Search lockfiles, caches, CI logs and running container digests for litellm 1.107.0 and the affected image tags. Floating tags such as latest are easy to miss.
- Treat any host where Python ran after installation as compromised. Preserve evidence, then rebuild from a reviewed artifact rather than cleaning in place.
- Rotate credentials reachable from those systems from a clean machine: cloud keys and sessions, GitHub and registry tokens, SSH keys, database passwords, and AI provider keys.
- Review cloud audit logs, especially AWS and Bedrock activity, for use of exposed keys. Socket also advises hunting for the loader lock file
/tmp/remote_code_loader.lockand egress to the fake litellm.dev domain. - Pin to a reviewed release and container digest. Socket cites 1.106.2 as the version Upwind recommends, though it does not certify every earlier artifact as clean (our analysis: pin by hash).
What we still do not know
How the attackers first reached the engineers’ accounts is not confirmed; LiteLLM reportedly suspects a recently patched vulnerability on an internet-exposed internal deployment. The number of organizations that installed the bad release has not been disclosed, nor how many had data stolen. Whether the loader ever delivered a second-stage payload is also unknown.
Sources: Socket, "LiteLLM PyPI Package and Docker Images Compromised" (analysis of Oct 21, 2026 events); Help Net Security, Oct 22, 2026; Check Point Research weekly report, Oct 26, 2026.
Leave a Reply