Overview
On October 21, 2026, attackers compromised the release pipeline of LiteLLM — one of the most widely used open-source AI gateway SDKs — and published a trojanised version (1.107.0) to PyPI and multiple Docker registries. With 92 million monthly downloads and adoption by enterprise names including NVIDIA, Netflix, AT&T, and Okta, the blast radius of this supply-chain attack is substantial. The malicious packages were live for approximately 100 minutes on PyPI and nearly three hours across Docker Hub and GHCR before being pulled.
Technical Analysis
The attacker did not modify LiteLLM’s application source code, a deliberate choice to avoid triggering source-level integrity checks. Instead, three malicious files were injected into the Python library directory within the installation package:
- cook.pth — a
.pthfile whose executable lines are processed by Python at interpreter startup - cook.py — the primary malicious module
- sitecustomize.py — a well-known Python hook executed automatically before any user code runs
By chaining .pth execution with sitecustomize import, the payload achieves pre-application execution on every Python invocation, making it largely transparent to the victim application. The malware’s stated objectives include stealing credentials, secrets, and environment variables, and loading remote-code execution tooling — effectively establishing persistent access and data exfiltration capability from the moment the compromised environment starts.
Affected artifacts:
- PyPI:
litellm==1.107.0(all seven wheels, Windows/Linux/macOS) - Docker Hub: tags
v1.107.0,latest,main-latest,main-stable - GHCR: equivalent tags across three image repositories
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| MITRE ATLAS | AML.T0010 – AI Supply Chain Compromise | Direct compromise of an AI SDK’s build/release pipeline |
| MITRE ATLAS | AML.T0115 – Publish Poisoned AI Artifacts | Malicious PyPI wheels and Docker images published to public registries |
| MITRE ATLAS | AML.T0083 – Credentials from AI Agent Configuration | Payload targets API keys, secrets, and env vars common in LLM gateway deployments |
| OWASP LLM | LLM05 – Supply Chain Vulnerabilities | Third-party package integrity failure enabling downstream compromise |
| OWASP LLM | LLM06 – Sensitive Information Disclosure | Exfiltration of credentials and environment secrets from AI infrastructure |
Impact Assessment
Given LiteLLM’s role as an abstraction layer across multiple AI provider APIs, compromised environments are likely to hold high-value secrets: OpenAI, Anthropic, Azure OpenAI, and other LLM provider API keys, plus internal service credentials. Enterprise deployments running automated pipelines with the compromised version may have had these credentials silently exfiltrated. The LiteLLM project confirmed that customers on the private enterprise offering were not impacted, narrowing confirmed exposure to open-source self-hosted users.
Mitigation & Recommendations
- Downgrade or upgrade immediately: Remove
litellm==1.107.0and install a verified clean version. Pin package versions and validate hashes. - Rotate all secrets: Any API keys, tokens, or credentials present in environments that ran the compromised version should be considered compromised and rotated immediately.
- Verify Docker image digests: Cross-check running containers against the known-bad image digests published in the LiteLLM post-mortem and rebuild from trusted base images.
- Enable PyPI hash pinning: Use
pip install --require-hasheswith a lockedrequirements.txtto detect tampered packages before installation. - Monitor for anomalous outbound connections: The RCE loader component suggests potential C2 beaconing; review egress logs from affected hosts.
- Treat
.pthandsitecustomize.pyas high-risk artefacts: Implement file-integrity monitoring for Python library directories in production environments.