LiteLLM 1.107.0 was poisoned for about two hours. Python ran the malware on every start.
By Lior AharonovFounder, 7IT Solutions ·
What happened
On 21 October 2026 attackers published a malicious litellm 1.107.0 to PyPI (live from 11:39 UTC) and to Docker and GHCR tags. Datadog says they used stolen GitHub CLI tokens from three engineers to run the release workflow against a lookalike fork. The package added three startup files, so any Python process in that environment ran the stealer.
Why it matters
Your build server, your laptop and your container all keep cloud keys, Git tokens and AI provider keys nearby. The malware went after exactly those. Deleting the package does not remove the startup files it dropped.
What to do
Search your lockfiles, CI logs and images for litellm 1.107.0 or the latest tag pulled on 21 October. If found, delete cook.pth, cook.py and sitecustomize.py, pin 1.106.2, then rotate every secret from a clean machine.
The code was clean. The release button wasn't. Your supply chain is only as safe as the laptop of whoever can press it.
Lior Aharonov · my takeSources
| LiteLLM 1.107.0 supply chain compromise (Datadog Security Labs) | securitylabs.datadoghq.com |
| LiteLLM release pipeline hacked to distribute info-stealer malware (BleepingComputer) | bleepingcomputer.com |
Researched with AI tools; every fact is checked against the linked sources.