New to this? Read it in simple words
  • LiteLLM is a free tool that connects apps to many AI models.
  • Attackers put a poisoned version, 1.107.0, online on October 21.
  • It tried to steal passwords and keys, including keys for AI and cloud services.
  • LiteLLM says users should stay on version 1.106.2 for now.
Words to know
PyPI
The main online store where Python programmers download ready-made code packages.
API key
A secret code that lets a program use a paid service, such as an AI model.
Supply-chain attack
An attack that hides harmful code inside software that many people download and trust.

LiteLLM is an open-source library and server from the company BerriAI. Developers use it to reach many AI providers, such as OpenAI and Anthropic, through one interface. On Wednesday, October 21, a poisoned version appeared on PyPI, the main store for Python packages.

What happened

Version 1.107.0 was on PyPI from 11:39 to 13:23 UTC, LiteLLM’s incident report says. Its Docker images, including the “latest” and “main-stable” tags, pointed to a bad image from 11:46 to 14:20 UTC.

An outside user reported the problem on GitHub at 12:06 UTC. PyPI then quarantined the release, and LiteLLM removed the bad images. Earlier versions are safe, LiteLLM says, and it asks users to stay on version 1.106.2 for now.

Sources123

Path
Three stolen logins, one poisoned release.

From LiteLLM’s incident report and three security firms’ analyses.

What the malware does

Three security firms, SafeDep, StepSecurity and Wiz, studied the package. They found hidden files that run every time Python starts, even if LiteLLM itself is never used.

The code collects cloud keys for AWS, Azure and Google Cloud, SSH keys, Kubernetes settings and passwords saved in browsers, the firms say. On LiteLLM servers, Wiz says, it also takes the AI provider keys stored in the database.

It sends the data to a lookalike web address. Every hour it also asks for a new server to take orders from, which would let the attacker run more code later.

Sources456

How the attackers got in

LiteLLM says the attackers used three engineers’ GitHub accounts, apparently with stolen GitHub CLI tokens. One account changed the release pipeline and started a release, and another approved it.

The bad packages were built from a repository the attackers controlled, not from LiteLLM’s official code. LiteLLM says it has revoked the tokens and, for now, removed all but one person from its GitHub organisation.

It has not yet found how the tokens were stolen. Its paid registry for enterprise customers was not affected, the company says.

Sources1256

Sources

Every fact in this story comes from the sources below. Open them to check our work.

  1. 1
    Primary source · October 21, 2026LiteLLM release v1.107.0 Compromised LiteLLM
  2. 2
    Primary source · October 21, 2026litellm 1.107.0 compromised: issue #47826 and LiteLLM’s status updates BerriAI (GitHub)
  3. 3
    Primary source · October 21, 2026litellm: release history PyPI
  4. 4
  5. 5
  6. 6
    Research · October 21, 2026LiteLLM Compromised, Steals Credentials Wiz
How we checked this story

The times and the account of the GitHub accounts come from LiteLLM itself. What the malware does rests on three security firms’ own analyses, which agree; no news outlet had done its own reporting yet.

More on this story

Mood: 2.5 out of 10 · Very negative

A poisoned LiteLLM release hid malware that steals cloud, SSH and AI keys, so anyone who installed it must treat machines as compromised. How we rate the mood

Basics explainedHow do AI agents fail? Real incidents What is prompt injection, and how do permissions help?
LiteLLMCybersecurityMalware In the AI incident log
Your next step · Claim CheckIs it hype or happening?