LiteLLM has disclosed a security incident involving a compromised software release pipeline that resulted in a malicious version of its Python package being published to package repositories and container registries. The incident affected LiteLLM version 1.107.0, which the company said contained unauthorized code capable of collecting credentials and executing additional commands from a remote server. According to LiteLLM, multiple security controls were compromised before the malicious package was distributed through PyPI and Docker Hub. The company said it identified the incident on October 21, 2026, and began investigating the release process, affected systems and possible sources of unauthorized access. Users who installed the affected package versions during the exposure window have been advised to remove the compromised release, investigate their environments and rotate potentially exposed credentials.
The compromised LiteLLM package included code designed to collect sensitive information from affected systems, including credentials, browser data, developer tools information, cloud access details and AI related secrets. Security researchers found that the malicious code used Python mechanisms to execute unauthorized scripts and establish communication with external infrastructure. Researchers said the package contained components capable of running additional code remotely, effectively allowing further actions on compromised systems. The malicious version used files including a Python path file and scripts that attempted to load additional content from external locations. According to security researchers, the malware collected information and transferred data through an external endpoint, increasing concerns for organizations that deployed the affected package within development or production environments.
Security researchers from organizations including Wiz, Aikido and JFrog analyzed the incident and provided additional details about the attack sequence. Aikido researcher Ilyas Makari said the malicious package created a background process designed to regularly contact attacker controlled infrastructure and retrieve additional commands. Wiz researchers noted that the incident involved techniques using both Python path files and site customization files, describing it as an uncommon combination observed in the wild. Wiz also reported observing attempts to use stolen credentials after data extraction, including checks involving cloud credentials and artificial intelligence related services. Researchers said some environments showed activity involving cloud identity checks and service discovery attempts, although the full impact remains under investigation.
LiteLLM said it had previously strengthened its release pipeline after an earlier security incident and had introduced additional protections, including moving releases to a private repository, making Docker tags immutable and signing container images. However, the company said temporary expansion of release permissions for internal engineers allowed attackers with access to developer GitHub CLI credentials to compromise the release workflow. LiteLLM stated that its investigation identified a possible connection involving GitHub CLI OAuth tokens appearing in logs from an internal deployment, though the exact method used to gain access remains under investigation. The company also identified an exposed internal user account that may have contributed to the compromise.
Security teams have advised organizations using LiteLLM version 1.107.0 to remove the affected version, isolate potentially impacted systems, search for malicious files, block suspicious communication channels and rotate all accessible credentials. Researchers emphasized that software supply chain security requires verification of released artifacts, not only trust in source repositories. The incident highlights the increasing importance of securing development environments, protecting access tokens and monitoring third party software components used across enterprise systems. As organizations continue adopting open source tools and AI related technologies, maintaining strong release security practices remains essential to reducing risks associated with compromised software packages.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
