LiteLLM supply chain breach ships credential-stealing malware in PyPI release 1.107.0
IgorCarron · x · 2026-10-22
- LiteLLM confirmed its release pipeline was compromised on Oct 21, pushing malicious version 1.107.0 to PyPI, Docker Hub, and GHCR containing a credential stealer that runs on every Python start, plus a remote-code loader backdoor.
- The attacker held GitHub CLI OAuth tokens from three engineers, used an org owner token to disable branch protections, and pointed the release workflow at a lookalike repo (Berri-AI/litellm). Tokens were likely harvested from logs of an internet-exposed internal deployment — LiteLLM notes Claude Code can embed users' GitHub CLI OAuth tokens in response bodies that may end up in logs.
- Affected artifacts were removed; enterprise releases unaffected. This is LiteLLM's second supply chain compromise of 2026; the March incident was linked to TeamPCP, no connection established. The community site internetonfire now tracks 33 incidents in the past week (LiteLLM, GitLab, Signal, Tailscale, Node, and more).
More from coding & agent
- Ruff author warns: upgrade Node/Bun now — --use-system-ca still accepts the eMudhra cert — charliermarsh · 2026-10-23
- Social AI 'Boba' launches: the hard part is knowing when to stay quiet in group chats — gharik · 2026-10-23
- New data marketplace lets vendors list repos; coding agents access via MCP server — testingcatalog · 2026-10-23
- AI agent payments debate: experts say agents need verifiable mandates, not credential sharing — AlexTensor · 2026-10-23
- MCP Tip: One-Line Instructions Beat Long Tool Descriptions, 18/20 vs 3/10 in Evals — colinmcnamara · 2026-10-23
- DynaLM: Open-Source CPU-First LLM Inference Engine Seeks Feedback — Unlikely_Safety_7456 · 2026-10-23