Pull to refresh
Logo
Daily Brief
Following Why Sign Up
Compromised LiteLLM release on PyPI and Docker installs credential stealer and backdoor

Compromised LiteLLM release on PyPI and Docker installs credential stealer and backdoor

Force in Play

Attackers broke into the AI proxy library's release pipeline, pushing credential-stealing malware to PyPI and Docker Hub

Yesterday: Branch protection overridden

Overview

Updated 1 hour ago

On October 21, 2026, attackers pushed a malicious version of LiteLLM, version 1.107.0, to PyPI and Docker Hub. The package contained malware that steals credentials and loads a remote code execution tool.

LiteLLM is a proxy library AI developers use to route requests to models from OpenAI, Anthropic, and other providers, with roughly 23 million weekly downloads. The malware ran at every Python process start, even processes that never imported the library, and security firm Wiz observed the attacker using stolen AWS credentials within hours.

Why it matters

If any machine ran LiteLLM 1.107.0, the malware grabbed cloud, SSH, browser, and AI-tool credentials and sent them to an attacker-controlled server.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

23M
Weekly downloads of litellm
Scale of the tool's user base at the time of the compromise.
2 hours
Time malicious package was live on PyPI
Published at 11:39 UTC, removed by 13:23 UTC.
7
Malicious wheels published to PyPI
All seven platform wheels of 1.107.0 contained the malware.
3
Developer GitHub credentials compromised
Each was used at a different stage of the release attack.
4.5 hours
Delay until stolen credentials were used
Wiz observed the attacker validating stolen AWS credentials within hours.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

UA
Unknown attacker
Unauthorized actor
Unidentified

Organizations Involved

LB
LiteLLM (BerriAI)
Software company
Recovering; advising users to pin to 1.106.2 and rotate credentials

The company behind LiteLLM, an open-source Python proxy for routing AI model requests.
Wiz
Wiz
Cloud security firm
Tracking post-exploitation credential abuse

Cloud security company that observed the attacker using stolen AWS credentials after the LiteLLM compromise.
JFrog
JFrog
Software supply chain security firm
Analyzed the malicious package

Supply chain security company that detailed the malware's credential theft and remote execution capabilities.
Anthropic
Anthropic
AI company
Claude Code's token behavior was a link in the attack chain

Maker of Claude and Claude Code, whose embedding of GitHub OAuth tokens in logged responses exposed them to the attacker.

Timeline

March 2026 October 2026

12 events Latest: Yesterday Showing 8 of 12
Tap a bar to jump to that date

  1. Branch protection overridden

    Latest Attack

    Privileged developer credential overrides GitHub branch protection to alter release workflow.

  2. Staging run from lookalike repo

    Attack

    Compromised workflow runs staging from attacker-controlled repository Berri-AI/litellm.

  3. Production release begins

    Attack

    Production release pipeline starts after staging completes.

  4. Release gate approved

    Attack

    Second developer credential approves the production release gate.

  5. Malicious wheels hit PyPI

    Exploit

    Seven malicious litellm 1.107.0 wheels uploaded to PyPI.

  6. Compromised Docker images published

    Exploit

    Malicious Docker images published under four tag names on Docker Hub and GHCR.

  7. Workflow records deleted

    Attack

    Third developer credential used to delete workflow records, limiting investigation.

  8. Workflow restored

    Response

    Unauthorized workflow revision removed, pipeline restored to prior state.

  9. PyPI pulls malicious package

    Response

    PyPI removes litellm 1.107.0.

  10. Docker Hub cleaned

    Response

    Docker Hub tags removed or repointed to verified clean images.

  11. Stolen credentials used

    Impact

    Wiz observes attacker validating stolen AWS credentials from compromised runners and nodes.

  12. Prior incident prompts CI hardening

    Security

    LiteLLM hardens CI pipeline after prior security incident.

Scenarios

1

LiteLLM publishes final post-mortem, attacker remains unidentified

Likely Resolves by Nov 21, 2026

Discussed by: LiteLLM incident report, security press

LiteLLM already published a preliminary post-mortem on October 21 identifying the attack chain through Claude Code token leakage. A final report is expected to confirm how the attacker gained initial access to the internal deployment, which the company suspects was through a recently patched vulnerability, and to state any attribution.

2

Downstream breach traced to stolen LiteLLM credentials

Possible Resolves by End of 2026

Discussed by: Wiz, The Hacker News

Wiz observed the attacker validating AWS instance role credentials from compromised CI runners and Kubernetes nodes within hours of the theft. If those credentials reached downstream organizations, affected companies may disclose breaches as they investigate.

3

PyPI and GitHub mandate release pipeline hardening

Uncertain Resolves by Apr 30, 2027

Discussed by: Security researchers analyzing the incident

The attack exploited mutable GitHub Actions workflow protections and unsigned artifacts. Security researchers are likely to press PyPI and GitHub to require build provenance and immutable release tags as a direct response.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

December 2020

SolarWinds supply chain attack (2020)

In December 2020, FireEye discovered that attackers had slipped a backdoor called SUNBURST into SolarWinds' Orion IT monitoring platform. Pushed through legitimate software updates, the malware reached roughly 18,000 customer organizations, including US federal agencies.

Then

The intrusion went undetected for months; FireEye disclosed it in December 2020, triggering a US government review.

Now

It drove a wave of supply chain security measures, including new federal requirements for software provenance.

Why this matters now

Shows how compromising one build pipeline distributes malware across a broad downstream user base.

April 2021

Codecov Bash Uploader compromise (2021)

In April 2021, an attacker modified Codecov's Bash Uploader script, which thousands of projects use to report code coverage from CI systems. The altered script exfiltrated credentials and tokens from customers' continuous integration environments for about two months.

Then

Codecov advised customers to rotate all credentials that flowed through affected CI environments.

Now

It became a standard case study in upstream tool compromise stealing CI credentials.

Why this matters now

Directly parallels LiteLLM: a popular developer tool compromised to harvest credentials from build and deployment environments.

March 2024

XZ Utils backdoor (2024)

In March 2024, engineer Andres Freund found a backdoor in XZ Utils, a widely used Linux compression library. The backdoor, planted over two years through a slow campaign against the project's maintainer, could have allowed remote code execution on OpenSSH connections.

Then

The backdoor was removed before mainstream Linux distributions shipped it.

Now

It showed how attackers can win trust in open-source projects through sustained social engineering.

Why this matters now

LiteLLM differs, a fast pipeline takeover rather than a slow trust build, but both target widely deployed open-source infrastructure.

Sources

(9)
+3
LiteLLM OSV Datadog Security Labs Hol AISLE ThreatCluster Hacker News Cyber Daily The Hacker News