On October 21, attackers published LiteLLM 1.107.0 to PyPI with a credential stealer and a remote access trojan baked in. The malicious wheels were live for 1 hour 44 minutes. The Docker tags, including latest and main-stable, pointed at the bad image for 2 hours 34 minutes. LiteLLM is a Python proxy library that sits in front of OpenAI, Anthropic, and every other LLM API. It has roughly 23 million weekly downloads. If your AI pipeline touched PyPI or Docker Hub during that window, read on.
The attackers did not find a clever zero-day in the build system. They stole GitHub CLI OAuth tokens from three BerriAI engineers and used them with actual role separation: one account triggered the private release workflow, a second approved it, a third deleted the workflow run records afterward. That last step is the part worth noting. Whoever did this knew the playbook, covered their tracks immediately, and was done and gone before most people noticed.
The payload is not subtle. It installs a credential stealer that runs at Python startup and collects cloud provider credentials, private keys, browser-stored passwords, and authentication files for AI development tools including LiteLLM’s own proxy configuration. A second-stage RAT is also present. Wiz observed active abuse of stolen credentials about 4.5 hours after the exfiltration started.
This is the second supply chain compromise of LiteLLM in 2026. The earlier incident, affecting versions 1.82.7 and 1.82.8, was attributed to TeamPCP by Datadog Security Research. Whether the same group is responsible for 1.107.0 has not been confirmed publicly. Two hits on the same project in one calendar year is not a coincidence, it is a targeting decision. LiteLLM is in production at a lot of companies proxying calls to every major LLM provider. The credentials stored in those environments are worth real money.
What to check if you were exposed:
# Check installed version before upgrade
pip show litellm | grep Version
# Check if malicious version was ever installed in a Python env
pip install --dry-run litellm==1.107.0 # should resolve to yankedIf any environment had 1.107.0 installed, or pulled Docker tags v1.107.0, latest, main-latest, or main-stable between 11:39 and 14:20 UTC on October 21: rotate every credential that process could have read. Cloud API keys, LLM provider keys, SSH keys, anything in ~/.aws, ~/.config/gcloud, .env files in the working directory. Assume the RAT established persistence; audit running processes and cron jobs.
All BerriAI tokens involved in the release are revoked. The malicious PyPI wheels and Docker images are removed. Upgrade to 1.107.1 or later once you have finished auditing. Pulling latest blindly without pinning is how you got here, and that part has not changed.
The XZ backdoor postmortem is worth reading alongside this: supply chain attacks keep happening because the trust model for open-source releases is basically “whoever controls the GitHub account.” The package registry typosquat wave from July covered a different vector but the same category of problem. CI/CD pipelines that pin nothing and pull latest from Docker Hub are standing offers.