LiteLLM 1.107.0 on PyPI carried a credential stealer and a backdoor. Both ran on every Python start via cook.pth and sitecustomize.py. The stealer collected SSH keys, cloud credentials, browser passwords and LLM provider keys. The backdoor contacted a GitHub file for a server address and ran code from it. PyPI removed the release at 13:23 UTC on 2026-10-21. Docker Hub and GHCR images for v1.107.0, latest, main-latest and main-stable were also malicious. LiteLLM confirmed the compromise in its incident report. The attacker used stolen GitHub CLI credentials to bypass branch protection and publish the release. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean. The companion packages litellm-proxy-extras and litellm-enterprise are also clean.
What changed
LiteLLM 1.107.0 on PyPI was clean and free of credential stealers or backdoors.
What it unlocks
Running arbitrary code on any host that installed LiteLLM 1.107.0 via pip or a Docker image.
- 7 malicious wheels published
- 13:23 UTC PyPI removal
- 11:46–14:20 UTC malicious Docker images live
- 61 KB stealer payload
What you need to act on it
- installed litellm==1.107.0 from PyPI
- used Docker images v1.107.0, latest, main-latest, or main-stable between 11:46–14:20 UTC
Sources