Observed incident

LiteLLM release compromise distributes credential-stealing malware

Reported

Published here

What happened

Attackers compromised LiteLLM’s release workflow and published malicious 1.107.0 Python wheels and container images containing malware that targets AI gateway, cloud and developer credentials.

Parties and reporting

AI tools and systems: LiteLLM 1.107.0, PyPI wheels, Official Docker Hub and GHCR images

Outcome

Malicious artifacts were removed. On October 22, maintainers said releases remained paused and the investigation continued. Affected-host and credential-loss totals are unknown.

Operating lesson

Validate release provenance against approved source repositories, rebuild affected environments from clean artifacts, and rotate reachable credentials from a clean system.

Evidence and limits

A live supply-chain compromise distinct from March’s incident. LiteLLM suspects developer tokens exposed in logged Claude Code responses enabled access; initial entry remains unconfirmed. Distribution containment does not establish customer remediation. Datadog reported no second-stage payload observed in the wild.

Sources