LiteLLM Supply-Chain Attack 2026

On October 21, 2026, an attacker compromised the release pipeline of LiteLLM — an open-source Python SDK and AI gateway (61,800 GitHub stars, ~92 million monthly PyPI downloads, used by NVIDIA, Netflix, AT&T, Okta) — and published a trojanized litellm==1.107.0 to PyPI and the project’s Docker registries. The malicious release lived about two hours on PyPI (11:39–13:23 UTC) and about three hours on Docker Hub/GHCR (11:46–14:20 UTC); the clean recovery version is 1.106.2. Customers pulling from LiteLLM’s private enterprise registry were not affected.¹

Attack chain

The attacker held GitHub CLI OAuth tokens for three LiteLLM developer accounts. LiteLLM’s investigation traces them to logs of an internet-facing internal LiteLLM deployment the attacker had accessed (the initial intrusion vector is unconfirmed); the incident report notes specific situations in which Claude Code embeds a user’s GitHub CLI OAuth token into a response body, and when response bodies are logged, those tokens land in LiteLLM logs. With one token belonging to a GitHub organization owner, the attacker disabled branch protection and force-pushed a workflow change that repointed the release at a lookalike repository, Berri-AI/litellm versus BerriAI/litellm, differing by a single hyphen. They then ran the compromised workflow, which signed and published the poisoned artifacts through the project’s normal Trusted Publishing path, and used a third credential to delete the workflow records afterward.²

The release permissions the attacker slid through had been temporarily widened that Monday so two engineers could ship daily bugfix backports — the ordinary scheduling decision that turned a two-party approval into a one-token override.

The payload

The application code was untouched; only the installation package was modified. Three files landed in the environment’s site-packages: cook.pth (a Python startup hook), cook.py (the info-stealer), and sitecustomize.py (a remote-access loader). Python processes executable .pth lines and imports sitecustomize at every interpreter start, so the payload runs before any application code — and running python or pip to investigate an affected environment retriggers it. The stealer collects cloud and deployment credentials (AWS, Azure, GCP, Kubernetes, Docker), AI provider keys and LiteLLM’s stored proxy credentials, developer secrets (Git, GitHub, npm, PyPI, CI/CD, .env files, SSH/GPG/TLS keys), browser data, and host/runtime state, encrypts the haul with AES-256-CBC under an RSA-4096 key, and POSTs it to litellm[.]dev/healthcheck. sitecustomize.py spawns a detached daemon that polls a GitHub-hosted pointer hourly and fetches further code; /tmp/remote_code_loader.lock and /tmp/.pc_once_* are the on-host markers.³

Why the signatures held

The official v1.107.0 source tag on GitHub contains no malicious files — the poisoned artifacts were built from the attacker’s repository and published through LiteLLM’s own signing and Trusted Publishing machinery.⁴ Docker tags were immutable and images were signed, controls added after the project’s first 2026 compromise in March (malicious PyPI releases via a breached Trivy scanner in its CI).⁵ A signature attests that an artifact has not changed since signing; it says nothing about whether the code was safe when the pipeline signed it. When the release workflow itself is the compromised asset, provenance attestation to “the official pipeline” is exactly what the attacker gets for free — see reproducible-builds for the verification model that closes this gap, and ledger-nanox-spy-implant-2026 for the hardware-side precedent.

Response

The project’s guidance treats the environment as breached rather than merely dirty: delete the three payload files (and __pycache__ copies) from the shell without starting Python, kill the loader daemon, reinstall pinned to 1.106.2 or rebuild images and venvs from scratch, then rotate everything the host could reach — the instance IAM role, every provider key in the LiteLLM proxy database plus master/virtual keys, the DATABASE_URL password, and any secret in any process environment — and check CloudTrail for GetCallerIdentity and out-of-infra use of the role around install time. Removing the package alone leaves the startup files and any active loader behind.⁶

What it demonstrates

A self-hosted AI gateway is a trust-concentration point: it holds every upstream provider key and sits in the request path of everything downstream, so its distribution channel is worth a multi-control compromise — the malware’s targeting list (LLM provider keys alongside cloud and CI/CD secrets) shows the attacker knew what the gateway hoards.⁷ The credential-hygiene detail is specific to the current tooling moment: an AI coding agent’s token leaked into another AI product’s logs, then funded a supply-chain attack on AI infrastructure. That leak channel belongs next to llm-context-engineering’s treatment of what ends up in context and logs, and the repeat-victimhood pattern (two compromised releases in one year, the second through controls added for the first) is a textbook common-mode-failure in process form: the hardening and the attack both ran through the same release workflow.⁸

Related

• reproducible-builds — the trust anchor this incident’s signatures couldn’t provide
• llm-inference-provider-landscape — where LiteLLM sits in the creator/hoster/aggregator stack
• common-mode-failure — correlated failure when one channel carries all the trust
• llm-context-engineering — sensitive tokens and what context/log plumbing does with them
• ledger-nanox-spy-implant-2026 — supply-chain implant, hardware edition

Sources

• Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised
• Bill Toulas 2026 — LiteLLM release pipeline hacked to distribute info-stealer malware

Footnotes

1. Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised ↩

2. Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised ↩

3. Bill Toulas 2026 — LiteLLM release pipeline hacked to distribute info-stealer malware ↩

4. Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised ↩

5. Bill Toulas 2026 — LiteLLM release pipeline hacked to distribute info-stealer malware ↩

6. Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised ↩

7. Bill Toulas 2026 — LiteLLM release pipeline hacked to distribute info-stealer malware ↩

8. Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised ↩