Pulp-style illustration of a rocket-age gateway machine with a sly robot slipping a glowing cartridge into its intake

LiteLLM 1.107.0 was poisoned: rotate every secret it could reach

ALERT · Actively exploited. Last updated 24 October 2026. See the Alert Tracker

For about two hours on 21 October, anyone who pulled LiteLLM 1.107.0 from PyPI or Docker got a credential stealer with it, and stolen cloud keys were being tested within hours. If that release ever ran on your machines, treat them as compromised and rotate every secret they could reach.

What happened

LiteLLM, the open-source AI gateway from BerriAI, says in its incident post that its release pipeline published a malicious litellm==1.107.0. All seven PyPI wheels were live from 11:39 to 13:23 UTC (12:39 to 14:23 UK time). The Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable pointed at poisoned images from 11:46 UTC until as late as 14:20 UTC. The official source tag is clean; the artefacts were built from a lookalike repository, Berri-AI/litellm.

LiteLLM’s root-cause analysis, published on 23 October, traces it to a master key for an internal agent platform, committed to a public repository in May and never revoked. On 10 October the attacker used it to obtain an organisation owner’s GitHub CLI token, then stole two maintainers’ tokens through CI workflows. On 21 October those tokens overrode branch protection, pointed the release workflow at the fork, approved the release and deleted the run records. It is the project’s second PyPI compromise this year, after versions 1.82.7 and 1.82.8 in March.

The wheels drop cook.pth, cook.py and sitecustomize.py into site-packages, so the payload runs every time Python starts in that environment, even if nothing imports LiteLLM. According to Microsoft and StepSecurity, the stealer takes cloud, CI and AI provider credentials, keys stored in the LiteLLM proxy database, SSH and GPG keys, browser data and environment variables, and sends them encrypted to www.litellm[.]dev. A second component polls a GitHub dead drop hourly for code to run; Datadog says that file only ever held test values.

Wiz puts downloads of the bad release at about 49,000. It saw stolen AWS credentials tested about four and a half hours after theft, followed by Amazon Bedrock calls consistent with LLMjacking, running AI models on the victim’s bill.

Who’s affected

You are affected if an unpinned pip install pulled LiteLLM during the PyPI window, or if you started one of the four Docker tags during the image window. Enterprise customers using LiteLLM’s private registry were not affected.

What to do now

  • Don’t start Python or pip to check: Microsoft and Datadog both warn that doing so runs the payload again, whatever LiteLLM’s own post suggests. Search from the shell for litellm-1.107.0.dist-info, cook.pth, sitecustomize.py and the run-once marker /tmp/.pc_once_72129118c59f5636c0bb, the best evidence that the stealer actually ran. Check lockfiles and image digests too: the poisoned Docker Hub digest is sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e, but there are three image indexes (litellm, litellm-database and litellm-non_root), so check against the digests in LiteLLM’s incident post. Finding nothing does not prove a host is clean.
  • Rebuild, don’t clean. Isolate affected hosts and kill any Python process holding /tmp/remote_code_loader.lock: the detached daemon keeps polling hourly on a running host, so a rebuild alone doesn’t stop it. Then rebuild images and environments from scratch on litellm==1.106.2, the last clean release. Removing the package leaves the startup files behind.
  • Rotate everything the host could reach. If it had internet access, assume the theft worked: the IAM role, every provider key in the proxy database, master and virtual keys, the DATABASE_URL password and any secret in a process environment.
  • Hunt and pin. Check CloudTrail for the sequence Wiz observed, sts:GetCallerIdentity followed by bedrock:ListFoundationModels, between 16:20 and 17:01 UTC on 21 October, and for the role’s credentials used from outside your network. Pin exact versions and image digests in CI, not floating tags.