Compromised LiteLLM PyPI package steals credentials
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Malicious LiteLLM 1.107.0 was uploaded to PyPI and pulled within hours, carrying a credential stealer.
Anyone who installed it should assume browser, cloud and AI secrets were exposed.
Background
LiteLLM is a Python SDK and proxy maintained by BerriAI that puts more than 100 LLM providers behind one OpenAI-compatible API. On Oct 21, 2026, a trojanized 1.107.0 release appeared on PyPI and in Docker images, though the upstream GitHub source did not contain the payload. It is LiteLLM's second reported supply chain compromise this year, after versions 1.82.7 and 1.82.8 were hit in March.
How it unfolded
- Mar 24, 2026TeamPCP used stolen Trivy pipeline access to obtain LiteLLM's PyPI publishing tokens and pushed trojanized releases 1.82.7 and 1.82.8, live for roughly three hours before maintainers pulled them.
- Oct 21, 2026 11:39 UTCMalicious version 1.107.0 of LiteLLM was uploaded to PyPI.
- Oct 21, 2026 11:50 UTCAbout 10 minutes after the upload, litellm-dispatcher[bot] published the release; no public GitHub Actions run built or published it.
- Oct 21, 2026 13:20 UTCVersion 1.107.0 was quarantined on PyPI.
- Oct 21, 2026 13:53 UTCTrojanized Docker containers on GHCR and Docker Hub, tagged v1.107.0, latest, main-latest and main-stable, were removed; Aikido reported the litellm/litellm:1.107.0 image was still live on Docker Hub.
Who’s saying what
- Analysts
- SafeDep said the 1.107.0 release carries a credential stealer and a remote code execution backdoor in all seven wheels, while the upstream GitHub source does not contain them.
- Analysts
- Wiz said the malicious version includes a credential stealer targeting browser, cloud and AI secrets plus a dormant C2 capability, and that the most recent safe version is v1.106.2.
- Caution
- Aikido said anyone who installed the affected release should assume credentials were exposed, and that replacing only the LiteLLM package is not enough when stolen credentials can still provide access elsewhere.
- Expert
- StepSecurity said the first payload is a credential stealer calling itself privcollect, and the second forks a background daemon that checks a GitHub dead drop every hour and runs whatever Python the attacker serves.
Still unverified
The GitHub repository github[.]com/letters9813 used as a dead drop currently returns a 404 error, according to StepSecurity's account.