LiteLLM Supply Chain Attack Steals Cloud, GitHub and AI API Credentials

A malicious release of LiteLLM, a popular AI gateway, has exposed developers and organizations to a serious software supply-chain threat. On October 21, 2026, attackers compromised the project’s release pipeline and distributed LiteLLM version 1.107.0 through PyPI and container registries.

The compromised release contained malware designed to steal sensitive credentials and establish a mechanism for executing additional remote code. Because AI gateways can access multiple model-provider API keys and cloud services, a single compromised installation could expose credentials across several systems.

LiteLLM confirmed the incident and published remediation guidance through its official security advisory.

Figure : LiteLLM 1.107.0 malware execution flow, illustrating the credential-stealing component and remote-code-loading mechanism. Source: Wiz Research.

What Happened in the LiteLLM Supply Chain Attack?

The attackers reportedly obtained access to developer GitHub credentials and used them to interfere with LiteLLM’s release workflow. This allowed malicious artifacts to be published through trusted software distribution channels.

Affected releases included litellm==1.107.0 on PyPI and compromised Docker Hub and GitHub Container Registry images associated with tags such as v1.107.0, latest, main-latest, and main-stable.

According to the incident reporting, the affected PyPI packages were available between approximately 11:39 UTC and 13:23 UTC on October 21. Organizations should check package installation records and container deployment history to determine potential exposure.

How the Malware Stole Credentials

Researchers identified malicious files named cook.pth, cook.py, and sitecustomize.py. These files abused Python startup behavior to trigger malicious functionality when the interpreter initialized.

The credential stealer attempted to collect cloud credentials, AI provider API keys, developer tokens, SSH keys, browser data, environment variables, and other accessible secrets. The collected information was encrypted and transmitted to attacker-controlled infrastructure.

The package also contained a backdoor mechanism that could periodically retrieve configuration information and execute additional Python code. Researchers reported this capability on Linux and macOS systems, although the presence of the mechanism does not establish that every infected machine received a second-stage payload.

Indicators of Compromise (IoCs)

Security teams should investigate the following indicators alongside package records and system telemetry:

• Malicious package: litellm==1.107.0
• Malicious files: cook.pth, cook.py, sitecustomize.py
• Reported exfiltration domain: litellm[.]dev
• Reported loader marker: /tmp/remote_code_loader.lock
• Reported dead-drop infrastructure: github[.]com/letters9813

Validate these indicators against the latest vendor advisories before deploying detection rules.

How to Protect Your Environment

Organizations that used the affected release should identify impacted systems, isolate suspected hosts, and rebuild environments from trusted artifacts. Simply uninstalling the package may not remove every malicious file.

Rotate potentially exposed GitHub tokens, cloud credentials, AI API keys, database passwords, and other accessible secrets. Review cloud audit logs and AI provider usage for suspicious authentication, model enumeration, or unexpected resource access.

Follow the latest LiteLLM security advisory for current recovery guidance.

Conclusion

The LiteLLM supply-chain attack demonstrates how compromised software releases can expose sensitive credentials across AI and cloud environments. Organizations should verify installed artifacts, protect release credentials, rebuild affected systems, and rotate potentially compromised secrets to reduce the risk of continued unauthorized access.