LiteLLM Compromised in Fresh Supply Chain Attack

On October 21, 2026, LiteLLM version 1.107.0 was compromised through a supply chain attack leveraging leaked GitHub CLI OAuth tokens from an internal deployment exposed to the public internet. Attackers used these tokens to disable branch protections, merge malicious changes redirecting release workflows to a lookalike repository, and publish signed malicious packages on PyPI and Docker. The malicious payload included an information stealer that harvested system info, browser credentials, developer credentials, cloud secrets (AWS, GCP, Azure), AI API keys, SSH keys, shell history, and GPG keys, sending encrypted data to a command-and-control server. A RAT component regularly checked for commands and executed attacker-supplied Python code. The malicious packages were online for approximately three hours and downloaded over 49,000 times before removal. Enterprise customers using private repositories were unaffected. The attack exploited a logging flaw in Claude Code that embedded tokens in response bodies, exposing them in logs. The attackers began abusing stolen credentials within hours, including querying Amazon Bedrock models, indicating potential LLMjacking activity.

Users who installed LiteLLM version 1.107.0 during the compromise window were infected with malware capable of stealing a wide range of sensitive data including system information, credentials, cloud secrets, and AI API keys. The malware also provided attackers with remote access and control over infected systems. This exposure risks credential theft, data exfiltration, unauthorized cloud resource access, and potential further lateral movement or compromise. Enterprise customers using private LiteLLM repositories were not affected. The malicious packages were downloaded over 49,000 times, indicating a significant exposure.

The malicious packages have been removed from PyPI and Docker Hub, and affected Docker tags have been removed or repointed to clean artifacts. Users who installed LiteLLM version 1.107.0 should immediately uninstall this version, upgrade to the latest clean version (1.106.2 or later), rotate all potentially exposed credentials including cloud and developer keys, and perform thorough malware scans on affected systems. Enterprise customers using private repositories were not impacted. There is no indication that further action beyond these steps is required at this time.