Version 1.107.0 of LiteLLM contained an infostealer and a remote access trojan, injected via a build-environment compromise rather than the source repo. The attacker abused the data = "cook" directive in pyproject.toml to bundle a nonexistent cook/ directory into compiled wheels on PyPI; the official Docker image was also affected. The infostealer exfiltrates credentials to an attacker-controlled domain, while the RAT polls a GitHub dead-drop hourly and executes unsandboxed payloads. PyPI has quarantined the version, Docker images were removed, and GitHub took down the attacker's repository.

AI summary of the linked source — not editorial content.

Story signal · how it spread on X · via Elfa

as of
Spread
i
Distinct X and Telegram accounts Elfa counted behind this story’s reports, summed over the thread. Not posts, not impressions.
16 accounts

first post
Leviathan +13.9 h later

Thread · 2 events · last update 21 Oct 22:53
  1. First reportLiteLLM 1.107.0 PyPI release compromised with credential-stealing malware8 acc.
  2. UpdateMalicious LiteLLM 1.107.0 release steals developer and cloud credentials8 acc.
  3. Leviathan published this article

All times UTC.

Cited posts

  • @The_Cyber_News Cyber Security NewsOn X ↗

    ‼️ Breaking: LiteLLM Compromised – Infostealer and RAT Injected in 1.107.0 PyPI Release Details: https://t.co/8rlH8xijjj LiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed…

  • @0xLogicrw 思维怪怪On X ↗

    安全公司 JFrog 发现，热门开源 AI 模型网关 LiteLLM 再次遭到供应链攻击。其最新的 1.107.0 版本被植入恶意程序，官方 Docker 镜像也受到影响。 LiteLLM 可以统一调用 OpenAI、Anthropic 等模型，并集中管理 API 密钥，今年 3 月就曾因另一场供应链攻击遭到投毒。 这次攻击更加隐蔽。黑客在 Python… https://t.co/P4PplZkGZC

  • @SocketSecurity SocketFirst reportOn X ↗

    🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.

Show 3 more cited posts
  • @TheHackersNews The Hacker NewsOn X ↗

    🚨 LiteLLM 1.107.0 compromised in a supply chain attack. Malicious PyPI packages and Docker images delivered a credential stealer and backdoor. ⚠️ The malware runs at Python startup, targeting cloud credentials, private keys, and AI tool credentials. 🔗 Full story:…

  • @DailyDarkWeb Dark Web IntelligenceOn X ↗

    LiteLLM hit by a new supply-chain compromise Researchers found credential-stealing malware in all seven LiteLLM 1.107.0 PyPI wheels and an official Docker image. LiteLLM sees 92M+ monthly downloads (h/t @SocketSecurity). * Python startup hooks can run the payload without…

  • @jrysana JohnOn X ↗

    This is the second time this year LiteLLM has compromised its millions of user credentials this year alone. They had a similar incident this March!!! Please: STOP using open source software with gigantic supply chains of transitive dependencies via pip, npm, cargo, etc. https://t.co/Fg6oC8Z4YS

10 more accounts posted about this

Social-monitoring data, not investment advice Elfa post text from Xas of

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…