LiteLLM supply chain compromise

The LiteLLM supply chain compromise involved attackers leveraging stolen GitHub CLI OAuth tokens from three engineers to push a malicious release of LiteLLM version 1.107.0. This release was distributed via PyPI and official Docker images for about two hours before removal. The malicious payload installed a credential stealer targeting various credentials including cloud, developer, AI-tool, browser, and LiteLLM proxy credentials. Additionally, it deployed a remote access trojan backdoor that executes automatically on Python startup through files dropped in the site-packages directory. This incident represents a repeated supply chain attack on LiteLLM in 2026, with no confirmed link to the earlier compromise attributed to TeamPCP. No CVE or patch information is available at this time.

The compromise allowed attackers to steal sensitive credentials across multiple domains (cloud, developer tools, AI tools, browsers, and LiteLLM proxies) and maintain persistent remote access via a trojan backdoor. This could lead to unauthorized access to critical systems and data. The malicious release was live for a short window (about two hours), limiting exposure but still posing significant risk to users who downloaded the compromised version during that time. There is no evidence of active exploitation beyond the supply chain compromise itself.

No official patch or remediation guidance is provided in the available data. Users should avoid using LiteLLM version 1.107.0 released on October 21, 2026, and verify the integrity of their LiteLLM installations. It is recommended to monitor official LiteLLM channels for updates or security advisories addressing this incident. Since this is a supply chain compromise, organizations should consider additional supply chain security measures such as verifying package signatures and restricting use of compromised versions. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.