LiteLLM 1.107.0 malicious release — how to check, and how one unrevoked key opened the pipeline
LiteLLM 1.107.0, pushed to PyPI and Docker on October 21, 2026, was a malicious release that steals cloud, AI and SSH credentials from the machine it is installed on. It began with a master key accidentally published on May 27 and left unrevoked for 136 days. The last safe version is 1.106.2; if you installed 1.107.0, rebuild the environment and rotate every secret it could reach
The three lines
- Affected — PyPI 1.107.0 (about 1h44m live) and four Docker tags including latest
- Root cause — master key leaked May 27, never revoked; attacker used it Oct 10
- Response — pin 1.106.2, rebuild environments, rotate all cloud, AI and database keys
Key questions
- litellm 1.107.0 malware
- **Version 1.107.0, published Oct 21, contained a credential stealer.** | Channel | Live window (UTC) | Status | |---|---|---| | PyPI litellm 1.107.0 | 11:39–13:23, about 1h44m | Quarantined | | Docker Hub v1.107.0, latest, main-latest, main-stable | 11:46–14:20 | Removed or repointed | | GHCR images | 11:46–13:51 | Taken down | | Last safe version | 1.106.2 | — |
- how to check if litellm compromised
- **Check install records, site-packages and network logs.** | Where | What | |---|---| | Lockfiles, pip/uv caches, build logs | litellm 1.107.0 | | site-packages | litellm-1.107.0.dist-info, cook.pth, cook.py, sitecustomize.py | | Network logs | litellm[.]dev, /healthcheck, /codepy | | Cloud audit logs | GetCallerIdentity from instance roles, Bedrock model listing |
- installed litellm 1.107.0 what to do
- **Don't run Python there again; rebuild and rotate everything.** | Step | Action | |---|---| | 1 | Don't run pip or python in the suspect environment | | 2 | Kill the process holding /tmp/remote_code_loader.lock | | 3 | Delete cook.pth, cook.py, sitecustomize.py | | 4 | Rebuild venvs and images, pin 1.106.2 | | 5 | Rotate cloud, SSH, CI, AI and database secrets; revoke sessions |
A Python library that sits between countless AI apps and their model providers was shipped by an attacker. LiteLLM is a gateway that lets developers call OpenAI, Anthropic, Google and other models through one interface. Version 1.107.0, published to PyPI and Docker on October 21, 2026, contained code that steals secrets. The maintainers released a root-cause analysis on October 23 and disclosed it publicly on October 24.
It started with a mistake five months earlier. On May 27, a configuration file containing a master key was committed to a public repository. The team removed the file but never revoked the key. The attacker used it 136 days later.
1. The 136-day timeline
| Date/time (UTC) | Event |
|---|---|
| May 27 | Config file with an Agent Platform master key committed to public repo LiteLLM-Labs/lite-harness; commit overwritten, key not revoked |
| Oct 10 | Attacker (IP 69.48.229.143) uses the key, pulls the GitHub org owner's CLI token — unscoped, owner-level |
| Oct 10, 22:11 | Malicious commits to internal repos; workflows harvest secrets, branches deleted |
| Oct 12 | Second commit widens collection (Anthropic, OpenAI, AWS Bedrock keys and more) |
| Oct 21, 10:08–11:08 | Branch protection overridden; release pipeline repointed to lookalike repo Berri-AI/litellm |
| Oct 21, 11:39 | 1.107.0 uploaded to PyPI (seven wheels) — one stolen token released it, another approved it |
| Oct 21, 11:46 | Docker Hub and GHCR images published |
| Oct 21, 12:06 | Upwind researcher reports the attack |
| Oct 21, 13:23 | PyPI quarantines 1.107.0 |
| Oct 21, 14:20 | Docker Hub tags removed or repointed |
| Oct 24 | Public disclosure |
The attacker waited eleven days after getting in, harvested secrets twice, then dressed the malware up as a normal release and deleted run records.
2. How to check whether you were hit
| Where | What to look for | Meaning |
|---|---|---|
| Lockfiles, pip/uv caches, build logs, internal mirrors | litellm 1.107.0 | Installed |
| Docker | Pulled v1.107.0, latest, main-latest or main-stable on Oct 21 | Image infected |
| site-packages | litellm-1.107.0.dist-info, cook.pth, cook.py, sitecustomize.py | Malicious files (absence doesn't prove safety) |
| Network logs | litellm[.]dev, /healthcheck, /codepy | /codepy means second-stage code ran |
| Cloud audit logs | GetCallerIdentity from instance roles; Bedrock model listing | Stolen credentials in use |
| Antivirus | Microsoft Defender Trojan:PyPI/Stealer.SA and related | Detection |
The key detail is the .pth file. Python automatically processes .pth files in site-packages at startup, so the stealer runs whenever Python starts in that environment — even if your code never imports litellm. Running pip on an infected host to "check" can execute the malware again.
3. If you installed it
| Step | Action |
|---|---|
| 1 | Do not run pip or python in the suspect environment |
| 2 | Kill the process holding /tmp/remote_code_loader.lock |
| 3 | Delete cook.pth, cook.py, sitecustomize.py and cached bytecode |
| 4 | Rebuild venvs and images from scratch; pin litellm 1.106.2 or a verified image digest |
| 5 | Rotate every secret the host could read — cloud, SSH, GPG, CI, registry, AI tools, databases |
| 6 | On a LiteLLM proxy, rotate all provider keys, master keys and virtual keys |
| 7 | Revoke sessions — rotated credentials may leave live tokens behind |
| 8 | Block litellm[.]dev at DNS and egress |
The stealer cast a wide net: AWS, Azure, Google Cloud and Kubernetes credentials, Git, npm and PyPI configs, .env files, SSH keys, shell histories, browser data and AI tool keys. On a LiteLLM proxy, it pulled provider keys from database tables up to 500 rows per query.
The lesson is the last line of every incident report: a key that was ever public must be revoked, even if the commit is gone. Rewriting Git history doesn't undo someone's copy. How stolen AI keys get abused is covered in "What is API key theft"; a similar npm incident in "What is an npm supply chain attack."
4. What remains unknown
- Scale: Downloads and confirmed infections of 1.107.0 are not public.
- Downstream abuse: Whether keys harvested on October 12 were used elsewhere is unconfirmed.
- Exact times: Quarantine and removal times differ by a few minutes across sources.
Sources
- The Hacker News — Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline
- DEV Community — Leaked LiteLLM Master Key Sat Unrevoked for 136 Days, Then Shipped a Malicious 1.107.0 Release
- Brandefense — LiteLLM 1.107.0 Compromised: What to Do Now
- Digital Today — LiteLLM deployment system compromised after admin key exposed by mistake