Skip to content
NewA calmer, faster ZeroHour
StoryMalwarehigh

LiteLLM unrevoked key led to malicious PyPI release 1.107.0

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

An unrevoked LiteLLM master key let an attacker publish PyPI 1.107.0, which harvested credentials before it was quarantined.

LiteLLM says a master key committed to a public GitHub repository on May 27 was never revoked, letting an unidentified attacker gain owner access to its repositories and publish PyPI package 1.107.0. The Register reports that on October 10 the attacker entered the LiteLLM Agent Platform, stole a GitHub CLI OAuth token, then took maintainer tokens. The trojanized release carried an infostealer and remote-access trojan that ran on Python startup and sought browser, cloud, and LLM-provider secrets. Wiz said it was downloaded about 49,000 times and stayed on PyPI about two hours; stolen AWS logins were tested within roughly four and a half hours, including against Amazon AI models. LiteLLM is revoking tokens and told anyone who ran 1.107.0 to treat reachable credentials as stolen.

Key facts
  • Master key committed publicly on May 27 and never revoked.
  • Attacker entered the LiteLLM Agent Platform on October 10.
  • Malicious PyPI release 1.107.0 drew about 49,000 downloads.
  • Package sought browser cookies plus AWS, cloud, and LLM secrets.
  • LiteLLM’s second PyPI supply-chain compromise this year.
  • March releases were later linked to TeamPCP; two men charged.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. May 27, 2026LiteLLM master key committed to public GitHub · The Register
  2. Oct 10, 2026Attacker entered LiteLLM Agent Platform with the key · The Register
  3. Oct 26, 2026Outlets report the malicious 1.107.0 PyPI release · The Record

What each outlet adds

beyond the shared facts
  • The RecordTwo-hour PyPI window, AWS login tests, and March TeamPCP cases.
  • The RegisterMay 27 exposure, October 10 intrusion path, and targeted secret types.
Vendors
LiteLLM
Products
LiteLLM
Threat actors
TeamPCP
Organizations
WizMicrosoftPyPI

Coverage

oldest first · one row per article · UTC
  1. · 5d ago The RecordFirst report

    Unrevoked LiteLLM key used to publish credential-stealing PyPI package

    Microsoft said the malware ran on every Python startup, and stolen AWS keys were checked against Amazon AI models.

  2. · 4d ago The Register · Security

    LiteLLM supply chain attack began with an unrevoked GitHub master key

    Poisoned release 1.107.0 carried an infostealer and remote access trojan and drew about 49,000 downloads before PyPI quarantined it.