Rotate credentials if you installed LiteLLM 1.107.0

Developers and organisations using LiteLLM version 1.107.0 face immediate risk to their cloud accounts and artificial intelligence provider credentials. This specific release, distributed on PyPI and via Docker images, contains malware designed to harvest sensitive data. According to Socket, the package acts as a credential stealer, targeting private keys, browser data, and authentication files for AI development tools.

What data is being stolen?

The malicious payload in LiteLLM 1.107.0 collects a wide range of sensitive information. Socket’s analysis confirms the code targets cloud credentials, developer secrets, and API keys for large language model providers. It also gathers browser data and authentication files. Because LiteLLM serves as a proxy for AI models, installations often sit alongside active database connection strings and cloud identities, making them high-value targets for attackers seeking persistent access.

How does the malware operate?

The threat operates through Python startup hooks embedded in the package. Socket found that the malware is distributed in seven wheel files across different operating systems. Crucially, the malicious code can activate during a normal Python startup sequence. This means the application does not need to explicitly import LiteLLM for the credential stealer to run. The payload also includes a loader capable of executing remotely supplied Python code, expanding its potential for further exploitation.

How was the compromise delivered?

Investigation by Upwind reveals that the attack reached container users via compromised Docker images. Build provenance data shows the release workflow used a source repository named Berri-AI/litellm. This differs by one hyphen from the legitimate BerriAI/litellm project. The malicious build occurred on 21 October 2026, recording a specific source revision that included the malicious startup files. This lookalike repository allowed the attacker to inject the payload into the official release workflow.

What evidence confirms the attack path?

The container registry’s provenance documents provide clear evidence of the delivery mechanism. The attached metadata identifies a private workflow run and a source revision containing files named cook.pth, cook.py, and sitecustomize.py. These files match the malicious payloads found in the PyPI wheels byte-for-byte. A commit added a setting to the Maturin build configuration to include these files. However, the public tag for the release lacks this setting, meaning reviewing the tag alone would miss the packaging change.

What affected people can do

Teams should immediately identify any environments where LiteLLM 1.107.0 was installed. This includes checking CI runners, proxy containers, and development machines. Verify whether Python processes ran after the installation, as the malware activates on startup. Rotate all cloud credentials, API keys, and database passwords that may have been accessible to these systems. Monitor for unusual outbound network traffic or new administrative accounts. Be wary of follow-up phishing attempts that reference this incident to trick staff into revealing new credentials.

What to do and how to stay safe: LiteLLM

• Audit your software supply chain to ensure you are not installing version 1.107.0 of LiteLLM from PyPI or Docker registries.
• Rotate all cloud provider credentials and AI API keys that were stored in environments where this package was present.
• Review logs for suspicious Python execution or outbound connections from servers that hosted the compromised package.
• Implement stricter verification for source repositories used in automated build workflows to prevent lookalike substitutions.

Step-by-step guide: Is It Safe to Use Password Managers? The Real Risks and Rewards

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attacker compromise the legitimate LiteLLM GitHub repository?

No, the evidence points to a lookalike repository named Berri-AI/litellm being used in the build workflow, not the official BerriAI/litellm repo.

Does the malware only run if I import LiteLLM in my code?

No, Socket confirms the malware uses Python startup hooks, meaning it can activate during a normal Python startup even if LiteLLM is not imported.

Is there a confirmed fix or patch available yet?

The source material does not state that a patch or fix has been released; it advises users to stop deploying the compromised version and investigate affected environments.