ON 21 October 2026, a malicious LiteLLM 1.107.0 release appeared on PyPI and GitHub’s container registry, ushering in a supply-chain compromise that plants a credential stealer which executes at Python startup. The attackers infiltrated a lookalike source repository named with a one-hyphen difference from the legitimate BerriAI/litellm, which allowed them to seed a hidden malicious payload into the build.
The payload is delivered via multiple artefacts: a .pth file and a sitecustomize script, meaning the theft can occur even if LiteLLM itself is not imported. The compromised wheels and container images were flagged by threat researchers within minutes of release, and affected variants included several “latest” and “main” tags.
The toolkit, described as a 16-module credential stealer, harvests a broad range of secrets: cloud provider credentials (AWS, Azure, Google Cloud), Kubernetes, Vault, Terraform, SSH keys, GPG keys, TLS keys, Git tokens, .env files, and browser databases. It also targets AI tool credentials and configurations for services such as Codex, Claude, Gemini, Cursor, Copilot, Windsurf, and Hugging Face.
Exfiltration is encrypted with AES-256 and RSA-4096, with data posted to a lookalike LiteLLM domain under a healthcheck path, and a hidden marker file written afterwards to impede repeated collection. A separate loader runs hourly, fetching Python code from a GitHub repository file and executing it without any signature or content-hash verification, creating a remote-commands capability.
Defence guidance emphasises banning the compromised 1.107.0 release, pinning digests, auditing lockfiles and CI logs, isolating affected hosts, and rotating every secret accessible to the Python process.