LiteLLM 1.107.0 on PyPI and Docker shipped a credential stealer and backdoor

A malicious version of LiteLLM, the widely used open-source Python gateway for calling large language model APIs, was published to PyPI and Docker registries on October 21, 2026, carrying a credential stealer and a remote code loader. According to reports from StepSecurity, Socket and The Hacker News, every wheel of litellm 1.107.0 and the matching container images were tampered with, putting cloud credentials, AI provider API keys and developer secrets at risk on any system where the release was installed. Socket says LiteLLM receives about 23 million downloads per week.

What happened

StepSecurity reports that the malicious wheels were uploaded to PyPI at around 11:39 UTC and removed by 13:23 UTC, roughly an hour and 45 minutes later. The infected Docker image was pushed at 11:48 UTC, and the latest, main-latest and main-stable tags pointed to it for about three hours before maintainer BerriAI removed the images at 14:32 UTC. Socket says its scanner flagged the seven wheels seven minutes after publication.

How the release was pushed is still under investigation. LiteLLM's director of security, Oliver Jensen, told The Hacker News that malicious actions were taken through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens: one account triggered the release workflow and another approved it. All involved tokens have been revoked, and the project removed all but one unaffected user from its GitHub organization. Both StepSecurity and Socket note that build provenance recorded a lookalike repository owner, Berri-AI, instead of the legitimate BerriAI, while the official v1.107.0 git tag is clean.

Technical details

According to the researchers, the wheels place three extra files in the root of site-packages: cook.pth, cook.py and sitecustomize.py. Because .pth files execute when the Python interpreter starts, the payload runs even if LiteLLM is never imported, including during pip and CI jobs.

StepSecurity says the stealer, named privcollect, runs 16 collection modules covering browser passwords, SSH, GPG and TLS keys, AWS, Azure, Google Cloud and Kubernetes credentials, CI secrets, shell history and configuration files of AI coding tools. If DATABASE_URL is set, it also dumps provider keys and model settings from the LiteLLM proxy database. The data is encrypted and sent to www.litellm[.]dev/healthcheck. A second component polls a GitHub-hosted pointer every hour and executes Python code served from a /codepy path.

Who is affected

Researchers list litellm==1.107.0 on PyPI and the v1.107.0 tags of ghcr.io/berriai/litellm, litellm-database, litellm-non_root and docker.io/litellm/litellm, plus the floating tags while they pointed to the malicious build. StepSecurity reports earlier 1.106.x releases and the 1.107.0 release candidates as clean. BerriAI said its private enterprise registry was not affected.

What to do

Check lockfiles, caches and running container digests for 1.107.0. Treat any host where it was installed as compromised: stop processes holding /tmp/remote_code_loader.lock, remove the three payload files, rebuild from clean images and pin litellm==1.106.2 by digest. Rotate every credential the system could reach from a clean environment, including cloud keys, LLM provider keys, LiteLLM master and salt keys, SSH keys and browser-stored passwords. Block litellm.dev and search egress logs for requests to it and to /codepy paths.