Trojanized LiteLLM 1.107.0 removed; users urged to rotate secrets
No developments after October 24, when LiteLLM traced the hijack to an unrevoked May master key used on October 10.
Malicious LiteLLM 1.107.0 is off PyPI and container registries; users should install 1.106.2 and rotate exposed credentials.
Attackers published trojanized LiteLLM 1.107.0 to PyPI and to Docker Hub and GHCR on October 21, 2026, including tags latest, main-latest, and main-stable. Startup files ran an infostealer and remote loader without importing LiteLLM, sending encrypted cloud, browser, SSH, and AI credentials to litellm.dev. PyPI hosted all seven wheels from about 11:39 UTC; BleepingComputer puts removal near 13:23 UTC, while Wiz Blog reports quarantine at 1:20 UTC, and some Docker tags lasted until 14:20 UTC. SecurityWeek reports more than 49,000 downloads; maintainers call 1.106.2 the latest safe release, say private enterprise registries were unaffected, and urge credential rotation. On October 24, LiteLLM traced access to an unrevoked May master key used on October 10 to steal GitHub tokens, beyond earlier exposed-log accounts.
- All seven PyPI wheels and tags v1.107.0, latest, main-latest, and main-stable were tainted.
- Maintainers call 1.106.2 the latest safe version; removal does not recover stolen secrets.
- Payload files cook.pth, cook.py, and sitecustomize.py ran at Python startup.
- BleepingComputer: GHCR tags stayed bad until 13:51 UTC; Docker Hub until 14:20 UTC.
- October 24 account: May 27 master key used October 10 from 69.48.229.143.
- Socket says public evidence does not link this to the March TeamPCP incident.
Timeline
dated events in the reporting · oldest first- May 27, 2026Unrevoked Agent Platform master key committed publicly. · The Hacker News
- Oct 10, 2026Attacker used the key to extract a GitHub OAuth token. · The Hacker News
- Oct 21, 2026Malicious LiteLLM 1.107.0 published to PyPI and containers. · Wiz Blog
- Oct 21, 2026PyPI quarantined the release; container tags removed later. · BleepingComputer
- Oct 24, 2026LiteLLM detailed the May key and October 10 token theft. · The Hacker News
What each outlet adds
beyond the shared facts- The Hacker NewsMay 27 master key, October 10 theft, attacker IP, and vendor secret targets.
- Microsoft Security BlogNames PRIVCOLLECT and does not confirm the second-stage fetch.
- SecurityWeekMore than 49,000 downloads and about three hours online.
- BleepingComputerGHCR tags remained compromised until 13:51 UTC.
- Wiz BlogPublished trojan hashes and says the second stage was never activated.
- Victims
- LiteLLM
Coverage
oldest first · one row per article · UTC- · 4d ago
Datadog Security LabsFirst report
Malicious LiteLLM 1.107.0 published with a credential stealer
PyPI and official Docker tags carried the release for about two hours; the RAT dead-drop never delivered a live second stage.
- · 4d ago
Wiz Blog
Trojanized LiteLLM 1.107.0 on PyPI steals credentials
PyPI quarantined the upload within about two hours; matching Docker tags included latest, main-latest and main-stable.
- · 4d ago
Hacker News · security
Compromised LiteLLM 1.107.0 on PyPI installs a stealer and backdoor
All seven wheels run the implants in every Python process; PyPI removed the release, and 1.106.2 plus two release candidates are clean.
- · 4d ago
Cyber Security News
Malicious LiteLLM 1.107.0 on PyPI shipped an infostealer and RAT
All seven wheels and several Docker tags were tainted; PyPI removed the release, and Wiz calls 1.106.2 the latest safe build.
- · 4d ago
The Hacker News
Malicious LiteLLM 1.107.0 ships stealer and backdoor
PyPI quarantined the release and Docker images were removed; users should pin 1.106.2 and rotate exposed credentials.
- · 4d ago
The Register · Security
Malicious LiteLLM 1.107.0 steals credentials and installs a RAT
PyPI and Docker removed the trojanized release within hours; the latest safe version named is v1.106.2.
- · 3d ago
GBHackers
LiteLLM 1.107.0 release carried credential-stealing malware
Malicious Python startup hooks can collect cloud and AI credentials even when applications never import LiteLLM.
- · 3d ago
SOCRadar
LiteLLM supply-chain attack reported on PyPI and Docker
The supplied page text does not describe the malicious packages, payloads, or who was affected.
- · 3d ago
Malicious LiteLLM 1.107.0 published after suspected token leak
Unpinned installs for a few hours on October 21 pulled a credential stealer and an hourly remote-code backdoor.
- · 3d ago
CSO Online
LiteLLM release pipeline hacked to distribute credential-stealing malware
Malicious version 1.107.0 stayed on PyPI for about two hours on October 21 before removal.
- · 3d ago
Help Net Security
Malicious LiteLLM v1.107.0 on PyPI and Docker stole credentials
The build stayed up for under two hours on PyPI; anyone who installed it is told to rotate credentials, not only upgrade.
- · 2d ago
BleepingComputer
LiteLLM release pipeline hacked to distribute info-stealer malware
Malicious LiteLLM 1.107.0 wheels and images were live for hours on October 21; roll back to 1.106.2 and rotate secrets.
- · 2d ago
SecurityWeek
Malicious LiteLLM 1.107.0 packages hit PyPI and Docker Hub
The poisoned build was online about three hours, downloaded over 49,000 times, and the latest clean release is 1.106.2.
- · 2d ago
Microsoft Security Blog
Compromised LiteLLM 1.107.0 steals credentials via Python startup
Starting Python with the package installed can run PRIVCOLLECT without importing LiteLLM; removing the package does not recover credentials.
- · 1d ago
LiteLLM GitHub secrets taken 11 days before malicious package release
October 10 and 12 workflows posted CI secrets to webhook.site; a key committed May 27 was never revoked.
- · 1d ago
Leaked LiteLLM master key used to steal GitHub tokens and publish malicious 1.107.0
An unrevoked Agent Platform key from May let an attacker publish LiteLLM 1.107.0 to PyPI on October 21; PyPI later quarantined it.