LiteLLM Removed Malicious Version 1.107.0 from PyPI and Docker Registries

LiteLLM 1.107.0 compromise affected the official distribution channels of the AI infrastructure project. The LiteLLM project confirmed that an attacker breached its release pipeline and published version 1.107.0 with compiled malware on PyPI and in official container registries. According to the project, affected environments should be considered compromised.

The malicious release was available on PyPI on October 21, 2026, from 11:39 to 13:23 UTC. It affected all seven wheels of the litellm==1.107.0 package. LiteLLM says the malware was intended to steal credentials and introduce tools enabling remote code execution.

The LiteLLM 1.107.0 compromise also included latest tags

The incident was not limited to the Python package. Container tags in Docker Hub and GitHub Container Registry were also compromised: v1.107.0, latest, main-latest, and main-stable. LiteLLM said it removed these tags or redirected them to verified clean artifacts.

The risk therefore affects not only teams that specifically installed package version 1.107.0, but also deployments using floating container tags. The project recommends temporarily pinning the dependency to version 1.106.2 or another explicitly specified older version. According to LiteLLM, older versions are safe and the private enterprise distribution was not affected.

What administrators should check

Organizations that installed litellm==1.107.0 during the stated window or ran one of the affected container tags should rebuild those environments from a clean base. Simply updating the package or changing the image tag is not sufficient, since the malware may have obtained credentials available while the application was running.

• Review the history of Python package installations and the image digests or tags used in container deployments.
• Rebuild affected systems from trusted artifacts and use explicitly pinned versions.
• Rotate API keys, database passwords, cloud credentials, and other secrets accessible to affected processes.
• Monitor for additional forensic information and indicators of compromise that LiteLLM may publish.

LiteLLM is a layer for accessing language models, so in typical deployments it often handles model-provider API keys, database access, or cloud identities. These credentials may have been at risk when the malicious artifact was executed.

The source of access to the release pipeline is still under investigation

The project said the attack exploited the accounts of three developers. It has already revoked the affected tokens. LiteLLM preliminarily attributes the access to stolen GitHub CLI OAuth tokens, but the method by which they were obtained is not yet known and the investigation is ongoing.

It has not been confirmed how many users downloaded or executed the malicious files. Specific successful data exfiltrations have likewise not been confirmed. According to LiteLLM, an older release record on PyPI by itself does not mean that the malicious file remains available; the compromised artifacts were supposed to have been removed.

Further information is expected primarily about the origin of the compromise, indicators of compromise, potential victims, and the attacker’s infrastructure. Any announcements from PyPI, Docker Hub, or GitHub about their own measures or additional affected artifacts will also be important.

Verified and updated: October 21, 2026 22:52