Affected Systems

LiteLLM version 1.107.0 on PyPI (all seven .whl packages for Windows, Linux, macOS) and Docker images (v1.107.0, latest, main-latest, main-stable) on Docker Hub and GHCR. Attack window: October 21, 2026, 11:39–14:20 UTC. Private enterprise customers not affected. Project has 92 million monthly PyPI downloads and is used by NVIDIA, Netflix, AT&T, Okta.

Exploitation Status

Active supply chain attack confirmed. Malicious version 1.107.0 was live on PyPI for ~1 hour 43 minutes and on Docker registries for ~2.5 hours. Detected by multiple security vendors within 6 minutes of publication. Malicious packages now removed.

Business Impact

High-severity credential theft targeting cloud infrastructure (AWS, Azure, GCP, Kubernetes), AI service credentials, developer secrets (Git, npm, PyPI, SSH keys), browser data, and environment variables. Malware persists via Python startup hooks (sitecustomize.py, .pth files) and downloads additional payloads hourly from attacker-controlled infrastructure. Exfiltrated data sent AES-256/RSA-4096 encrypted to litellm[.]dev/healthcheck. Simply running pip or Python in affected environments triggers execution. This is LiteLLM's second supply chain breach in 2026 (previous in March via compromised CI/CD).

Urgency

🔴 Immediate

Recommended Actions

  • Immediately isolate and rebuild any system that installed LiteLLM 1.107.0 between October 21, 11:39–14:20 UTC; do not attempt cleanup by running Python or pip commands
  • Rotate all credentials and secrets on affected systems: AWS/Azure/GCP keys, Kubernetes tokens, Docker credentials, GitHub/Git tokens, SSH/GPG keys, API keys in .env files, and AI provider credentials
  • Inspect Python site-packages directories for cook.pth, cook.py, and sitecustomize.py without launching the interpreter; remove entire LiteLLM installation and verify no startup hooks remain
  • Downgrade to LiteLLM 1.106.2 (last clean release) or upgrade to post-incident patched version once available; pin dependencies and verify package hashes in CI/CD pipelines
  • Monitor network traffic to litellm[.]dev/healthcheck and block outbound connections; review cloud audit logs (CloudTrail, Azure Activity, GCP Audit) for unauthorized access using potentially stolen credentials