On October 21, 2026, the LiteLLM project released version 1.107.0 containing a credential stealer. The malicious code was present in the PyPI package and Docker images tagged as v1.107.0, latest, main-latest, and main-stable. The incident occurred due to a compromised release pipeline, despite security measures implemented after a previous breach in March 2026.
Attackers gained access to three GitHub CLI OAuth tokens belonging to developers and one token from an organization owner. This allowed them to bypass branch protection, modify the release workflow, and approve the malicious build. The modified workflow pulled code from a spoofed repository, Berri-AI/litellm, instead of the official BerriAI/litellm.
The malware installed three files—cook.pth, cook.py, and sitecustomize.py—which executed upon any Python interpreter start. It exfiltrated environment variables, cloud credentials, and AI tool tokens via an encrypted HTTP POST request to litellm.dev. The compromised images were available for approximately 2.5 hours, while the PyPI package was live for about 1 hour and 45 minutes.
BerriAI suspects the initial entry point was an internal LiteLLM deployment exposed to the internet, which logged full request and response bodies containing developer tokens. The company recommends that users who installed the affected version rotate all credentials, including cloud roles, SSH keys, and vendor API keys stored in the LiteLLM database.
To mitigate future risks, experts advise deploying software by digest rather than by tag, using lock files with hashes, and restricting outbound traffic. Organizations should also enforce hardware-based approval for releases, implement automated expiration for temporary access rights, and avoid logging sensitive request data.
