LITELLM was compromised in a contemporary supply‑chain incident, with malicious packages pushed to PyPI and Docker Hub. The attackers abused GitHub CLI OAuth tokens that had been leaked from an internal LiteLLM deployment exposed to the public internet. They used these credentials to disable branch protections, merge a change redirecting the releaser to a lookalike repository, and run a compromised GitHub workflow that pointed to a malicious repository, allowing the poisoned artifacts to be signed and published.
The incident unfolded on 21 October 2026, and the tainted LiteLLM version 1.107.0 remained online for roughly three hours, reportedly downloaded more than 49,000 times before removal from PyPI and Docker Hub.
According to LiteLLM’s investigation, the malware acts as both an information stealer and a remote access tool. The payload harvests system information, browser credentials, environment variables, cloud secrets (including AWS, GCP and Azure), API keys for AI tools, SSH keys, and other sensitive data, then encrypts and exfiltrates it to litellm[.]dev.
Wiz and others noted that stolen credentials were used within hours to access AWS resources and query Amazon Bedrock models, pointing to broader credential abuse and potential LLMjacking. Enterprise customers pulling from LiteLLM’s private repository were not affected. The guidance from Security Week’s report is clear: affected users should remove LiteLLM 1.107.0, rotate credentials, and upgrade to the clean version, 1.106.2, while scanning for indicators of compromise.