LiteLLM, an open-source Python library for AI model routing, suffered a supply chain attack after a master key was accidentally committed to a public GitHub repository on May 27, 2026. The key remained active for 136 days without being revoked.
On October 10, an attacker used the key to access sensitive tokens, including a GitHub CLI OAuth token, allowing them to compromise the project's CI workflows. This led to the release of a malicious version, 1.107.0, on October 21, 2026.
The compromised package was available on PyPI and Docker registries for approximately two hours. During this time, it was downloaded an estimated 49,000 times. The malicious code, dubbed privcollect, automatically executed upon Python startup.
The payload was designed to steal API keys and credentials and included a remote code execution backdoor. This incident marks the second supply chain attack for LiteLLM in 2026, following a breach involving a Trivy dependency in March.
LiteLLM advises users who installed version 1.107.0 to rotate all credentials that were present in the affected environments. The project highlights the necessity of auditing old deployments and securing CI access.
