LiteLLM release 1.107.0 backdoored on PyPI and Docker after maintainer GitHub tokens were stolen
What happened
Attackers used stolen GitHub CLI tokens from LiteLLM engineers to run the release pipeline and publish version 1.107.0 with a credential stealer. The package was live for under two hours on PyPI before quarantine. It is the second LiteLLM supply chain compromise this year.
Attackers used stolen GitHub CLI OAuth tokens from three LiteLLM engineers' accounts. One account triggered a release run and another approved it. Wiz identifies a lookalike repository named Berri-AI/litellm. Version 1.107.0 was uploaded to PyPI at 11:39 UTC on 21 October and to Docker Hub and GHCR under the version, latest, main-latest and main-stable tags.
The code was designed to run whenever a Python interpreter starts. It went after browser data, cloud and AI credentials, SSH and GPG keys and shell history, and sent them to a lookalike domain. On Linux and macOS a second component polled a GitHub file for a domain; the file held only test values and the second-stage payload was never seen active. About four and a half hours after exfiltration began, the attacker started validating stolen AWS credentials. Wiz cites about 49,000 downloads of the release, which counts downloads, not victims.
How it happened
Supply chain and access: Poisoned package. A malicious or tampered AI package, extension, plugin or MCP server was published and installed by users.
The software involved works with many AI models, so no single model maker was involved. The product was LiteLLM, which is open source, a type of AI building block.
Impact
Data was exposed. Data involved: credentials. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 21 Oct 2026. It became public on 21 Oct 2026, 0 days later.
PyPI quarantined the release at 13:20 UTC, under two hours after the upload, and the malicious Docker images were removed. LiteLLM's security director said all tokens involved were revoked, most unaffected users were removed from its GitHub organization as a temporary measure, and the investigation was continuing with the attack vector still being traced. Wiz names 1.106.2 as the most recent safe version.