LiteLLM malware release stole credentials from developers
A compromised release of LiteLLM version 1.107.0 distributed credential-stealing malware through multiple package distribution channels on October 21, 2026, marking a significant supply-chain compromise affecting developers worldwide.
Attack scope and distribution
The malicious package was published to PyPI at approximately 11:39 UTC and remained available for about two hours until removal at 13:23 UTC Microsoft Security Blog. All seven PyPI wheel variants of the affected version were reported compromised GitHub issue tracking.
Compromised Docker images spread through multiple registries. The `litellm/litellm:1.107.0` image on Docker Hub, along with tags marked `latest`, `main-latest`, and `main-stable`, remained exposed from 11:46 UTC to 14:20 UTC Bleeping Computer. GitHub Container Registry images under `ghcr.io/berriai/litellm` were similarly affected Microsoft Security Blog.
Malware capabilities and attack method
The embedded malware was designed to harvest sensitive credentials across multiple attack surfaces. Reported theft targets included cloud credentials, environment variables, browser credentials and cookies, AI-tool authentication data, CI/CD pipeline credentials, private keys, and SSH/GPG/TLS cryptographic material The Register. The malware also included a loader capable of retrieving or enabling remote-code-execution tooling, expanding the threat beyond credential theft.
Access to the release pipeline was obtained through stolen developer GitHub credentials belonging to maintainers at BerriAI, the company behind LiteLLM. Attackers used these credentials to alter the legitimate release workflow and redirect it to a look-alike repository registered as `Berri-AI/litellm` rather than the authentic `BerriAI/litellm` LiteLLM Security Advisory.
Response and impact containment
PyPI removed the malicious package following discovery, and affected Docker images were removed or redirected to verified secure sources Bleeping Computer. LiteLLM announced that its private enterprise customers were not affected by the incident LiteLLM Security Advisory, though the full scope of exposure among open-source users downloading the package during the two-hour window remains unclear.
The incident underscores the vulnerability of Python package distribution channels and container registries to supply-chain attacks targeting AI infrastructure, even when affecting widely-used libraries with significant developer adoption.
