LiteLLM v1.107.0 Compromised with Malware Stealing Credentials and Enabling Remote Code Execution

• LiteLLM's release pipeline was compromised on October 21, 2026, resulting in the publication of v1.107.0 containing compiled malware that steals credentials and loads remote-code execution tools.
• The malicious PyPI package litellm==1.107.0 was live from 11:39:51 to 13:23 UTC, while compromised Docker images (v1.107.0, latest, main-latest, main-stable) were available from 11:46:56 to 14:20 UTC.
• The attack succeeded because an attacker compromised three sets of developer GitHub CLI credentials, using one belonging to a GitHub organization owner to disable branch protections and force-push a change pointing the release workflow to a lookalike repository (Berri-AI/litellm).
• Users who installed v1.107.0 or ran the affected Docker images must delete specific files (cook.pth, sitecustomize.py), kill the detached Python daemon, and rotate all provider keys, IAM roles, and database passwords, assuming data exfiltration occurred if the host had outbound internet access.

Attack Vector and Investigation

• The attacker gained access to LiteLLM's internal deployment, which was exposed to the public internet, and extracted GitHub CLI OAuth tokens from logs where they were embedded by Claude Code.
• The compromised artifacts were built from an attacker-controlled repository, while the official v1.107.0 source tag in GitHub remains clean.
• Enterprise customers using the private LiteLLM registry were not impacted by this incident.

Remediation and Status

• LiteLLM has removed the compromised packages from PyPI, Docker Hub, and GHCR, and revoked maintainer credentials to the minimum necessary.
• Users are advised to pin their version to litellm==1.106.2 or any explicit version published prior to the incident.