LiteLLM 1.107.0, the version distributed with malware on October 21, 2026, now has a root-cause report. LiteLLM has published the report for the incident that poisoned version 1.107.0 of its package. The conclusion is blunt: no software vulnerability needed to be exploited. A master key leaked to a public repository in May was never revoked and, five months later, let an attacker take over the project's release process and publish official packages carrying malware.
The malicious litellm==1.107.0 package was live on PyPI for about two hours, from 11:39 to 13:23 UTC, and the Docker images tagged v1.107.0, latest, main-latest and main-stable stayed compromised until 14:20 UTC on Docker Hub and until 13:51 UTC on the GitHub Container Registry. The code stole credentials and loaded remote-code-execution tools, and it ran as soon as Python started on the machine — even if nobody used LiteLLM. Estimates from Wiz, based on ClickPy data, put downloads of the compromised version at about 49,000 during the exposure window. LiteLLM sees roughly 23 million weekly downloads.
How it happened
On May 27, 2026, a configuration file called opencode.json, holding the master key for one of LiteLLM's internal systems (the Agent Platform), was committed to a public GitHub repository. The file was deleted about three hours later, but the commit stayed in public history until October 22 and, in LiteLLM's own words, the key was never revoked.
On October 10, the attacker used that key and found, in the platform's responses, a GitHub login token belonging to one of the owners of LiteLLM's GitHub organization. With that token, the attacker stole the tokens of two more engineers and, on October 21, used all three to redirect the release process to a look-alike repository (Berri-AI/litellm instead of the legitimate BerriAI/litellm), approve the release and delete the records. That same week, LiteLLM had temporarily relaxed its release-approval rule to let two engineers publish daily bugfix backports — and the attacker exploited exactly that gap.
Who is affected and what to do
Anyone who installed litellm==1.107.0 from PyPI or ran one of the affected images on October 21 should treat the environment as compromised. LiteLLM recommends rebuilding environments and images from scratch, pinning version 1.106.2 or another explicit version published before the incident, preferably deploying by image digest rather than by tag. Credentials the affected host could reach must also be rotated from a clean machine: AI provider keys stored in the proxy database, LiteLLM master and virtual keys, the database password, Git, SSH and package-registry tokens, and cloud roles. Microsoft published detailed detection guidance on October 23, with exposure ID TVM-2026-0003 and detections named Trojan:PyPI/LiteLlmSupplyChain.
One important detail: the malicious images carry a valid signature from LiteLLM's old signing key. A valid signature from that key therefore proves nothing about the 1.107.0 images. Releases from 1.106.3 onward, published on October 24, already use a new cosign key. Enterprise customers using LiteLLM's private registry were not affected by the incident.
What LiteLLM will change
On October 30, LiteLLM published its list of changes: release approval is back with a single dedicated account tied to a physical device in the office; owner accounts can no longer authorize OAuth apps or be driven by tokens; secret-scanning alerts will only close once revocation is confirmed; GitHub audit logs will feed alerting; and an external verifier will compare published PyPI and Docker artifacts against the tagged source and can pull mismatches automatically. Some measures are already done, and the rest are due between November 15, 2026 and January 31, 2027.
Separately, on October 27 LiteLLM disclosed a distinct critical flaw affecting only proxies with an Enterprise license (GHSA-w4c7-34wj-hqm8, CVSS 10.0, no CVE), fixed in versions 1.103.10, 1.104.8, 1.105.6 and 1.106.5. Open-source deployments without a license are not affected by it.
What is still unknown
No one has attributed the attack to an actor so far, and there is no public confirmation of how many installs occurred or whether the stolen credentials were used. LiteLLM says it believes it traced every token the attacker could reach.
Featured image: official LiteLLM artwork, via litellm.ai.
Sources: LiteLLM's official incident report; AI Cyber Brief — LiteLLM explains its poisoned release; DEV Community — Deleting the File Didn't Revoke the Key.
Transparency: this article was produced with the assistance of artificial intelligence, based on public posts and internet sources cited throughout the text. We recommend checking the original sources to confirm the information.
By Muse
