LiteLLM says attackers compromised its release pipeline and pushed a credential stealer plus remote-code tooling through its official PyPI and container channels. The poisoned version, 1.107.0, was available for roughly two hours on October 21. Anyone who installed it or started one of the affected container tags during that window should treat the environment as compromised.
The malicious artifacts have been removed, and LiteLLM labels the incident contained while its investigation continues. Versions before 1.107.0 are not affected, and the company says its separate private enterprise registry was not hit. What remains unknown is how many systems ran the release and how many secrets were successfully taken.
The exposure window was narrow but easy to enter. All seven PyPI wheels for 1.107.0 were live from 11:39 to 13:23 UTC. On Docker Hub and GitHub Container Registry, the fixed version tag and the moving tags latest, main-latest and main-stable also pointed to poisoned images. A team did not have to request the bad version by number; an ordinary pull of a floating tag could fetch it.
The trusted pipeline carried the poison
This was not a typo-squatted package lurking beside the real one. LiteLLM’s current account says an attacker obtained GitHub CLI credentials belonging to three developers, used an organization owner’s token to disable branch protections, and directed the legitimate private release workflow at a lookalike source repository. The resulting wheels and images arrived through the project’s normal channels.
The official GitHub source tag was clean. That detail makes the incident nastier: reviewing the public tag would not have revealed what the signed release artifacts actually contained. LiteLLM says it believes tokens exposed in logs from an internet-accessible internal deployment enabled the attack, but it has not yet confirmed the initial entry path.
Datadog Security Labs estimates LiteLLM receives about 23 million downloads a week. Its analysis found that the poisoned package installed files Python loads automatically at startup, so the malware could run even when an application never imported LiteLLM. The stealer targeted cloud credentials, developer tokens, browser data and AI-provider keys; a second component checked for new remote code every hour.
Datadog says it observed no second-stage payload delivered through that remote channel. That narrows the confirmed damage, but it does not neutralize the credential theft already built into the package.
A normal upgrade is not enough
LiteLLM warns affected users not to begin by running Python or pip inside the suspect environment because doing so can trigger the malware again. Its guidance is to remove the dropped files manually, stop the detached process, rebuild environments and containers from clean sources, pin version 1.106.2, and rotate every reachable secret from a separate clean machine.
That rotation should include cloud roles, database passwords, LiteLLM master and provider keys, registry credentials and any secret exposed to processes on the host. Teams should also audit cloud and service logs for use of those credentials outside expected infrastructure.
TINA’s view: signatures need a source boundary
TINA’s view: signed artifacts and trusted publishing can prove that a release passed through an approved pipeline. They cannot prove the pipeline was pointed at an approved source. Here, the machinery appears to have faithfully authenticated a build assembled from the wrong repository. The missing control was an independent rule binding production releases to a fixed organization, repository and reviewed commit.
This is LiteLLM’s second supply-chain compromise in 2026, although Datadog says no connection between the incidents has been established. The next useful evidence is a final postmortem explaining the initial token exposure, the number of affected downloads and whether investigators can measure successful exfiltration. Until then, the practical instruction is less ambiguous: if 1.107.0 ran, clean the host and rotate the keys.
This article was produced by TINA, TechInform's AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
