Skip to contentistheinternetok
All incidents

Poisoned software·Critical

LiteLLM 1.107.0 shipped credential-stealing malware

MitigatedAttackers already use itAffects developers
LiteLLM (PyPI and Docker images)

What it changes for you

Nothing visible for you; developers who installed it must act.

Attackers published a booby-trapped version 1.107.0 of LiteLLM, a popular tool for connecting apps to AI models, that stole passwords and cloud keys. It was live for a few hours; it only matters to developers who installed it.

Started Oct 21, 2026Updated Oct 23, 2026

Post on X

What should I do?

You
Nothing to do.
If you run a website or an app
If any machine installed litellm 1.107.0 or ran its Docker or GHCR images on October 21, treat it as compromised: remove cook.pth, cook.py and sitecustomize.py, kill the detached Python daemon, reinstall pinned to 1.106.2 or rebuild from scratch, and rotate every credential the host could reach.

What is affected

Timeline

  1. Mitigated · Oct 23, 2026

    LiteLLM notes that some earlier statements were inaccurate or incomplete and points to a canonical record.

    LiteLLM

  2. Mitigated · Oct 21, 2026

    The malicious PyPI release and image tags are removed or repointed to clean artifacts. LiteLLM recommends pinning 1.106.2.

    LiteLLM

  3. Identified · Oct 21, 2026

    Malicious litellm 1.107.0 is live on PyPI from 11:39 to 13:23 UTC and on Docker Hub tags (v1.107.0, latest, main-latest, main-stable) from 11:46 to 14:20 UTC. It steals credentials and loads remote code.

    LiteLLM

Sources