Attackers used three stolen developer GitHub credentials, including an org owner's, to force a modified release workflow through a lookalike repo and publish malicious litellm 1.107.0 wheels (11:39 UTC) and Docker images (11:46 UTC). The payload installs Python startup hooks that steal cloud, AI provider and proxy credentials and run an hourly remote code loader. PyPI pulled it at 13:23 UTC. Anyone who installed it must clean site-packages, rebuild and rotate every reachable secret.
What to do: Malicious release pulled; every host that installed 1.107.0 (11:39 to 13:23 UTC Oct 21) stays compromised until cleaned and its secrets rotated. Root cause: a master key leaked on GitHub in May was never revoked; attackers reached the Agent Platform, took a GitHub owner token and published the PyPI release. Microsoft: the payload ran when Python started, no import needed, so do not use Python or……
AI angle: LiteLLM notes Claude Code can embed GitHub CLI tokens in responses that then land in LiteLLM logs; stolen tokens came from an internet-exposed internal LiteLLM deployment. Second LiteLLM compromise of 2026 after March.
For under two hours on Wednesday, installing LiteLLM from PyPI could have put malware on your machine. LiteLLM, a popular open-source tool for connecting apps to AI models, says release 1.107.0 was poisoned to steal cred
A compromised LiteLLM 1.107.0 release added files that Python could execute during normal interpreter initialization. Applications did not need to import LiteLLM for the payload to run; starting Python in an affected environment could be enough. https://msft.it/6012axjt8 Microso
🚨 LiteLLM reveals the root cause of its supply chain attack. A master key leaked on GitHub in May was never revoked, allowing attackers to access its Agent Platform, steal a GitHub owner token, and publish a malicious PyPI release in October. Read:
LiteLLM, an open-source tool widely used by artificial intelligence developers, said a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users.
Why this score
A core AI gateway library with very wide install base (impact 3), malware executed on every Python start (exploitability 3), general sector (criticality 0).