TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
LiteLLM confirmed that version 1.107.0 on PyPI contained malicious code that could steal credentials and run remotely supplied code. PyPI removed the release on Oct. 21, 2026, and the company said several Docker image tags were also affected; earlier listed versions and two pinned companion packages were reported clean.
LiteLLM confirmed that its 1.107.0 release contained a credential stealer and a backdoor capable of running remotely supplied code. PyPI removed the package by 13:23 UTC on Oct. 21, 2026, but the same compromised release was also present in several Docker images, according to SafeDep’s report.
SafeDep reported that all seven 1.107.0 wheels for Linux, macOS and Windows installed three additional files into Python’s site-packages directory. Two of those files use Python startup mechanisms, so their code can run when a Python process starts—even when the process does not import LiteLLM. The affected processes may include applications, package tools, development environments and CI jobs running on the same host.
The report says one file collects information including SSH keys, cloud credentials, CI/CD secrets, browser passwords, AI development-tool tokens and provider keys stored in a LiteLLM proxy database. It describes the collected data being encrypted and sent to a domain using the LiteLLM name. A separate startup file launches a background process that checks a GitHub-hosted file for a server address, repeats collection and downloads code to execute. SafeDep reported that the GitHub account and repository used to supply that address returned 404 at 13:40 UTC.
According to SafeDep, the affected Docker Hub and GitHub Container Registry tags were v1.107.0, latest, main-latest and main-stable, and carried the code between 11:46 and 14:20 UTC on Oct. 21. The report lists 1.106.2, 1.107.0rc1 and 1.107.0rc2 as clean, as well as the pinned companion packages litellm-proxy-extras 0.4.110 and litellm-enterprise 0.1.78. These findings do not establish whether any particular user’s credentials were accessed or misused.
Risk Across Python Environments
The startup behavior broadens the potential exposure beyond software that deliberately uses LiteLLM. If the compromised package was installed in an environment, the malicious files could run when other Python programs start there, putting credentials accessible to that account or process at risk. The scope depends on the host, its permissions and what secrets were available.
The backdoor also creates a continuing risk distinct from the initial collection: the reported daemon could retrieve and execute code from a server address controlled through the GitHub-hosted file. That means removing or upgrading the package alone may not answer whether a host was already affected. Organizations that installed the release may need to investigate the environment and credentials it could access, following LiteLLM’s incident guidance.
The incident also involved distribution channels users often rely on as signals of trust. SafeDep says the official release pipeline built, signed and published the artifacts after the attacker redirected its workflow. A valid-looking package or image therefore did not, in this case, guarantee that its contents matched the public source code.
Python security tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
How the Release Was Altered
SafeDep found that the malicious files were not present in LiteLLM’s public GitHub source. Its analysis instead identified an extra maturin data setting in the 1.107.0 source distribution’s pyproject.toml. That setting caused a cook directory to be included in the built wheel and installed into site-packages. The source distribution did not include the cook directory itself, making the added build configuration the reported visible change.
LiteLLM’s incident report says the attacker obtained GitHub CLI credentials belonging to three developers, which the company believes were taken from logs of an internal deployment exposed to the internet. The report says an organization owner’s token was used to bypass branch protection and direct a private release workflow to a lookalike repository. A second developer’s credential was then used to pass an approval gate, after which the official workflow built, signed and published the artifacts.
SafeDep reported that the malicious release appeared on PyPI and in container images on Oct. 21. PyPI had removed the package by 13:23 UTC. The affected Docker tags were available during a reported interval from 11:46 to 14:20 UTC. Those timestamps define the reported exposure windows; they do not show how many users downloaded or ran the compromised artifacts.
“The attacker held the GitHub CLI credentials of three developers.”
— LiteLLM, in its incident report as summarized by SafeDep
Exposure and Impact Still Unknown
The available reports do not say how many people or organizations installed the compromised package or pulled the affected images. They also do not establish how many hosts executed the payload, whether credentials were successfully exfiltrated, or whether the backdoor delivered additional code to any victims. A repository returning 404 does not, on its own, show whether all related infrastructure or copies of the code were disabled.
LiteLLM’s account attributes the incident to stolen developer credentials and a redirected release workflow. The details here are based on the company’s incident report and SafeDep’s technical analysis; the material provided does not include an independent account of the credential theft or a confirmed list of affected customers. It is also not clear whether every potentially exposed credential was rotated or whether all affected images were purged from every cache.
Users should distinguish package status from host status: the release’s removal from PyPI prevents new installs there, but does not remove files already installed or determine whether a running host was compromised.
Audit Installs and Rotate Secrets
LiteLLM’s incident report lists remediation steps, and SafeDep advises treating systems that installed 1.107.0 or ran affected image tags as potentially exposed. Organizations should consult the vendor’s current guidance, check package and container deployment records against the reported versions and time windows, and investigate affected environments rather than relying only on a package upgrade.
Where exposure is possible, responders should review accessible credentials and secrets—including cloud, CI/CD, SSH, browser, AI tool and LiteLLM proxy credentials—and rotate them through the relevant providers. They should also examine host and network activity for signs of unexpected collection or code execution. These are response measures for potentially affected systems, not confirmation that every installation was exploited.
The next key developments are further findings from LiteLLM’s investigation, clarification of the reach of the compromised artifacts, and updates to remediation guidance. Users should verify current package and image status against the project’s official incident communications before returning affected environments to service.
Key Questions
Which LiteLLM version was compromised?
LiteLLM 1.107.0 on PyPI was compromised. SafeDep reported that versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 were clean.
What did the malicious package do?
SafeDep found a credential stealer that could collect secrets and other data, and a background component that could download and run code. Both were placed in Python’s site-packages startup path and could run when Python started, even without importing LiteLLM.
Were Docker images affected too?
Yes. SafeDep reported that Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable carried the malicious code between 11:46 and 14:20 UTC on Oct. 21, 2026.
Does removing or upgrading the package prove a system is safe?
No. Removal or upgrade does not establish whether the payload ran earlier or whether credentials were accessed. Organizations that installed the release or used an affected image should follow LiteLLM’s incident guidance and assess the host and its accessible secrets.
Source: hn
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
