LiteLLM release pipeline hijacked to publish a credential-stealing version, the second time this year
October 21, 2026 (October 21, 2026)
On October 21 attackers published LiteLLM version 1.107.0 to PyPI and to its official Docker images. It carried an infostealer and a remote access trojan, and was live for roughly two hours (11:39 to 13:23 UTC on PyPI). LiteLLM says the attackers used GitHub CLI tokens stolen from three engineers' accounts, reportedly found in the logs of an internal deployment, to disable branch protections and run its release workflow against a lookalike repository, so the build looked legitimate. LiteLLM says earlier versions are safe and its private enterprise release was not affected. There is no CVE. Datadog tied the earlier March compromise to TeamPCP; none of the sources reviewed attribute this one.
Why it matters
LiteLLM sits between applications and AI providers, so it holds provider API keys, cloud identities and database credentials. It has about 23 million weekly downloads.
What defenders can take from it
- If 1.107.0 was installed or a Docker image was pulled in that window, treat the host as compromised and rotate every key it could reach.
- Pin to a confirmed-safe version such as 1.106.2 instead of installing the latest.
- Maintainers: lock release workflows to approved repositories and treat developer CLI tokens as high-value secrets.