LiteLLM 1.107.0 supply chain compromise delivers a credential stealer and backdoor; stolen credentials abused

LiteLLM's release pipeline was compromised early on October 21, 2026 through three engineers' GitHub accounts, apparently using GitHub CLI OAuth tokens taken from logs of an exposed internal LiteLLM deployment. The attacker pointed the releaser at a lookalike Berri-AI/litellm repository and published a malicious litellm 1.107.0 release to PyPI, live from 11:39 to 13:23 UTC, and compromised Docker and GHCR images under the tags v1.107.0, latest, main-latest and main-stable from 11:46 to 14:20 UTC. All of the affected artifacts have since been pulled or quarantined, and LiteLLM says customers on its private enterprise release were not impacted. The last clean release is 1.106.2.

All seven 1.107.0 wheels carry cook.pth, cook.py and sitecustomize.py, which run on every Python startup, even in a process that never imports LiteLLM: a credential stealer harvesting SSH, GPG and TLS keys, AWS, GCP and Azure and Kubernetes, Docker and Git credentials, browser passwords and cookies, AI tool tokens and the provider keys stored in a LiteLLM proxy database, exfiltrated to litellm[.]dev, plus an hourly backdoor daemon that fetched a GitHub dead drop domain and executed remote code. Wiz observed post-exploitation abuse starting about 4.5 hours after exfiltration, from 16:20 to 17:01 UTC on October 21, validating stolen AWS instance role credentials taken from CI runners and Kubernetes nodes with GetCallerIdentity and LLMjacking style Bedrock and ListModels checks, plus IAM enumeration in a small number of environments. Anyone who installed or ran 1.107.0 should remove the three implant files, rebuild from a clean environment, and rotate every credential the host could reach.

Sources: LiteLLM; The Hacker News; SafeDep; Wiz