LiteLLM release hijacked: malicious 1.107.0 hit PyPI and Docker

A popular AI gateway got burned by its own release. LiteLLM says attackers slipped a malicious 1.107.0 build into both PyPI and Docker Hub around 4:00 a.m. on 21 Oct 2026, and it carried a credential stealer plus a backdoor.

LiteLLM disclosed that “multiple independent security controls” were bypassed, and the team now suspects a leaked GitHub token in AI Gateway logs handed over the keys that mattered. The Python Package Index (PyPI) later quarantined the tainted package, but not before it propagated through typical install paths.

What happened

LiteLLM said its release pipeline was compromised to push 1.107.0 to the Docker Hub registry and PyPI repository the morning of 21 Oct 2026. The activity was pegged to around 4:00 a.m., narrowing the window when consumers might have pulled the bad build.

Security firms SafeDep, Socket, StepSecurity, and Upwind reported that the package embedded both a credential stealer and a backdoor, elevating it from nuisanceware to a concrete risk for anyone who installed or based an image on 1.107.0 during that time.

The malicious 1.107.0 reached users through normal Python wheels and accompanying Docker images, according to the published analyses, which means environments that auto‑pull latest tags or don’t pin exact versions were squarely in the blast radius.

PyPI has since quarantined the compromised version, cutting off new installs from the canonical Python repository. That quarantine action limits additional spread but does not disinfect existing environments that already fetched dependencies or containers during the affected window.

LiteLLM suspects a GitHub token leaked via AI Gateway logs was the initial foothold used to subvert its controls. That finding suggests logging pipelines can inadvertently capture secrets and later expose them, especially when verbose modes include headers or tokens.

The project’s statement that multiple independent security controls were compromised implies that defense‑in‑depth was present but not decisive here, highlighting how CI/CD pipelines with several gates can still fall if a high‑value credential is reused across steps.

The background

The incident is a textbook software supply chain attack because the trusted distribution channels—PyPI for Python wheels and Docker Hub for container images—were used to deliver the payload, rather than a separate phishing lure or exploit site.

Email teams often depend on Python libraries and containerized tools for sending, parsing, and webhooks, which means a compromised build like 1.107.0 can quietly inherit access to SMTP keys, marketing APIs, or CRM integrations if those secrets are mounted at runtime.

We’ve seen adjacent patterns in other ecosystems this year: a ConnectWise Cloud Backup credential compromise let unknown actors hop into 173 Microsoft 365 tenants, underscoring how a single secret can unlock many downstream accounts.

Attackers also regularly piggyback on reputable platforms to scale delivery. A recent phishing takedown disrupted infrastructure behind more than a billion messages by exposing how malicious services abuse mainstream cloud accounts to host and relay content.

State‑sponsored operators have even shifted payload hosting onto developer platforms. Researchers tracking North Korea’s Kimsuky noted a move to code‑sharing sites in a campaign against Ukraine‑focused analysts, demonstrating why developer ecosystems are irresistible to threat actors.

If your team experiments with AI gateway tooling, the suspected GitHub token leak via logs is a cautionary tale: verbose AI service logs can capture headers and auth tokens, and those artifacts might later surface in ticket systems or observability tools where access is broader.

For readers tracking broader security trends, our security coverage hub collects recent cases where trusted plumbing—not user clicks—was the initial vector, reinforcing the need to treat build and logging paths as production attack surfaces.

What people are saying

LiteLLM said attackers compromised “multiple independent security controls,” signaling the project did not rely on a single check and that the adversary likely chained weaknesses across the pipeline rather than brute‑forcing one gate.

The team also pointed to a GitHub token leak in AI Gateway logs as a probable source of the attacker’s access, which narrows the investigative scope to logging retention, redaction settings, and token scoping in the project’s observability stack.

Third‑party watchers including SafeDep, Socket, StepSecurity, and Upwind analyzed the package contents and agreed the 1.107.0 release carried both a credential stealer and a backdoor, which raises the response bar from “uninstall” to “assume credential exposure.”

PyPI’s quarantine of the tainted version shows registry operators can act quickly to contain spread, but it also illustrates a boundary: registries can block future downloads, yet they cannot reach into already‑built Docker layers or virtualenvs to remove bad code.

Docker users who track latest tags without image digests or signature checks face added risk in these scenarios because rebuilds silently pull whatever is current; pinning specific shas can provide a backstop when a registry image version is swapped out.

What happens next

LiteLLM’s investigation will likely revolve around how a GitHub token ended up in AI Gateway logs and how many independent controls it could unlock once exposed, with particular attention to log redaction and secret scoping inside CI/CD runners.

Downstream users who installed 1.107.0 or built on the Docker images during the morning of 21 Oct 2026 need to account for credential theft risk because investigators say a credential stealer was embedded in the package.

Teams will have to audit where that version landed—package indexes, lockfiles, and container registries—and compare against the quarantine status on PyPI to ensure stale mirrors or internal caches don’t continue to serve the compromised build.

Expect ecosystem maintainers and security vendors to publish more granular indicators of compromise once static and behavioral analyses of the 1.107.0 code are complete, which should help automate detection across codebases, build logs, and container layers.

Organizations with AI gateway components will likely tighten log scrubbing for tokens and review who can read raw logs, because LiteLLM’s suspected token leak route indicates that observability tooling can double as an exfiltration channel if secrets aren’t redacted.