LiteLLM discloses supply chain compromise of v1.107.0 release

On October 21, 2026, the LiteLLM team released an incident report detailing a supply chain attack that allowed attackers to publish a malicious version of the popular AI model gateway library.

Release pipeline breach

Attackers compromised multiple GitHub CLI OAuth tokens belonging to developers and used them to bypass branch protections and redirect the release workflow to an attacker-controlled repository. The malicious build was published to PyPI for roughly two hours between 11:39 and 13:23 UTC, and affected Docker images were live for a similar window.

The official source tag on GitHub remained clean; the malware was injected during the build process from the lookalike repository. Enterprise customers using the private registry were not impacted.

Malware behavior and reach

The compromised wheels installed three additional files that execute automatically on every Python interpreter startup, even without importing LiteLLM. On affected systems the malware harvests cloud credentials, AI provider API keys, environment variables, SSH keys, and browser data, then exfiltrates them to an attacker-controlled endpoint. A background remote code loader component also checks periodically for further instructions on Linux and macOS.

Immediate actions for users

• Pin installations to version 1.106.2 or an earlier known-good release.
• If version 1.107.0 was installed or the affected Docker tags were used during the exposure window, treat the environment as compromised.
• Rotate all credentials that the host could access, including those stored in any LiteLLM proxy database.
• Remove the malicious files (cook.pth, cook.py, sitecustomize.py) and rebuild environments from scratch where possible.

Practical implications for AI teams

Many organizations run LiteLLM as a central proxy for routing requests across multiple large language model providers. A compromise at this layer can expose keys for every downstream model an application uses. The incident reinforces the value of strict dependency pinning, reproducible builds, and monitoring for unexpected Python startup hooks in production AI infrastructure. Teams that rely on unpinned or latest tags in container orchestration should review their update policies for similar tooling.

The LiteLLM team has revoked affected credentials and restored the release workflow. Further updates are expected as the investigation continues.

Sources

• docs.litellm.ai

Cover photo by Santhosh Kanthala on Pexels, used under the Pexels License.