LiteLLM 1.107.0 poisoned on PyPI and Docker: which secrets to rotate

A release pipeline compromised on October 21

LiteLLM is an open-source Python SDK and gateway that lets applications query models from several AI providers through a single API. According to the post-mortem published by its maintainer and reported on October 22, 2026 by Bleeping Computer, the project’s release pipeline was compromised on October 21. An attacker reportedly pushed a version 1.107.0 containing compiled malware to both PyPI and Docker registries. This article relies on that single source, and the details below are the ones it reports.

The project is widely used: Bleeping Computer cites 92 million monthly downloads on PyPI and 61,800 stars on GitHub. According to the maintainer, customers of the private enterprise edition were not affected. Several application security firms reportedly detected the attack within six minutes of publication.

Affected versions and images

On PyPI, the seven wheels of litellm==1.107.0, for Windows, Linux and macOS, were online from 11:39:51 to 13:23 UTC.

On Docker Hub, the tags v1.107.0, latest, main-latest and main-stable pointed from 11:46:56 to 14:20 UTC to the compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e.

On GHCR, the same tags pointed to compromised indexes from 11:46:56 until they were actually removed at 13:51 UTC. Three images are affected: ghcr.io/berriai/litellm (sha256:1bbcb1443bc9…), ghcr.io/berriai/litellm-database (sha256:c00f9d92c427…) and ghcr.io/berriai/litellm-non_root (sha256:7b00e91cd2fe…). The source only gives these digests in truncated form.

An image pulled during these windows through the latest or main-stable tag is therefore affected, even if you never asked for version 1.107.0. The recommended fallback version is 1.106.2, the last clean release before the attack.

What the malicious code collected

According to the researchers cited, LiteLLM’s application code was not modified. Only the installation package was, so that it dropped three files into the environment’s Python library directory: cook.pth, cook.py and sitecustomize.py. At startup, Python executes the executable lines of .pth files, then tries to import sitecustomize. According to Endor Labs, the payload therefore runs before the application every time Python starts in the environment, including when you launch Python or pip to examine a suspicious installation.

The targeted data:

• cloud and deployment credentials: AWS, Azure, Google Cloud, Kubernetes, Docker, infrastructure management tools;
• authentication files for AI development tools, as well as the provider credentials and model settings stored by LiteLLM;
• developer secrets: Git, GitHub, npm, PyPI, CI/CD, .env files, SSH, GPG and TLS keys;
• browser data: saved credentials, cookies, autofill and payment data, history;
• environment variables, shell and application histories, system and network information.

The data was encrypted with AES-256-CBC, using a key itself encrypted with RSA-4096, then sent to litellm[.]dev/healthcheck, an address you should search for in your network logs. The sitecustomize.py file also launches a detached loader that checks a GitHub-hosted pointer every hour, then downloads Python code from an external server and runs it on the machine.

What to do now

The malicious packages have been removed, but existing installations remain infected. The reported recommendations:

• stop affected deployments and inspect them without starting the Python interpreter;
• isolate infected machines and rebuild them from clean backups: deleting only the package directory can leave the startup files or an active loader in place;
• immediately rotate every exposed secret: cloud keys, Kubernetes and Docker access, AI provider keys configured in LiteLLM, GitHub, npm, PyPI and CI/CD tokens, the contents of .env files, SSH, GPG and TLS keys, and passwords saved in the machine’s browsers;
• reinstall LiteLLM at version 1.106.2.

The project had already been compromised in March: the TeamPCP group published malicious versions on PyPI at the time, after compromising Aqua Security’s Trivy vulnerability scanner, which was used in LiteLLM’s CI/CD pipeline.

The whole point of an AI gateway is to centralize model access keys. On an affected machine, you should therefore assume the attacker knows every secret it held, not just the ones belonging to LiteLLM.