LiteLLM 1.107.0 compromised with credential stealer and backdoor

BerriAI

Tools official + media 3 src. ~1 min

LiteLLM's release pipeline was hijacked on October 21, 2026: seven PyPI wheels and Docker Hub/GHCR tags of 1.107.0 shipped a sitecustomize.py credential stealer and an hourly GitHub dead-drop loader, while the official GitHub source tag stayed clean. BerriAI traced it to stolen GitHub CLI OAuth tokens lifted from an exposed internal deployment's logs; remediation is pinning litellm==1.106.2, deleting cook.pth, cook.py and sitecustomize.py, and rotating all credentials.

Why it matters

The proxy fronts many teams' model and cloud keys, so an install-time stealer reaches AI-provider credentials in one hop.

Importance: 4/5

active supply-chain compromise of a widely deployed AI proxy

supply-chain security malware developer-tools

Sources

official Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised

media LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

secondary LiteLLM supply chain compromise: What you need to know