LiteLLM supply chain attack delivers credential stealer

The popular LiteLLM Python package was compromised in a supply chain attack that delivered a credential stealer and a backdoor. The compromise affects LiteLLM version 1.107.0, which was distributed through PyPI wheels and Docker images. Docker Hub and GHCR images for the compromised version were published at 11:46 a.m. UTC on October 21, 2026.

The attack vector involved stolen GitHub CLI OAuth tokens used by threat actors to hijack the release pipeline. The threat actor used one user's account to trigger the project-releaser run and another user's account to approve it. The malicious version is equipped to collect cloud credentials, private keys, browser data, and authentication files for AI development tools. The malware includes a credential stealer named 'privcollect' and a background daemon that checks a GitHub dead drop every hour.

The root cause was a configuration file accidentally published to a public GitHub repository in late May 2026 containing an unrevoked master key. The attacker used the unrevoked master key on October 10, 2026, to gain access to the Agent Platform and extract a GitHub CLI OAuth token. The threat actor overrode branch protection and altered the release pipeline with the source set to the lookalike repository "Berri-AI/litellm" on October 21, 2026. The attacker operated from the IP address 69.48.229[.]143.

All tokens involved in the attack have been revoked by LiteLLM. As a temporary mitigation, LiteLLM removed all but one unaffected user from its GitHub organization. PyPI quarantined the trojanized version of LiteLLM within hours of its release. The Docker image litellm/litellm:1.107.0 was removed from both Docker Hub and GHCR soon after publication. The most recent safe version of LiteLLM is v1.106.2. An earlier LiteLLM compromise in March potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines worldwide. LiteLLM receives about 23 million weekly downloads.