LiteLLM release pipeline compromised
On 21 October 2026 a compromised release pipeline of LiteLLM, the open-source AI gateway and Python library, published a malicious version 1.107.0: the PyPI wheels were live from 11:39 to 13:23 UTC and four Docker image tags were affected until 14:20 UTC. LiteLLM says the package contained compiled malware that steals credentials and loads remote-code-execution tools. The project rewrote its account of the intrusion two days later: the first post blamed GitHub tokens that reached the logs of Claude Code sessions, the final one traces them to a key committed to a public repository on 27 May and never revoked.
Why it matters
A package that sits between applications and model providers, and so holds their API keys, was turned into a credential stealer through the project's own release process, not through its code. How the account changed matters: the first post named a flaw in how Claude Code handles tokens; the canonical record does not mention Claude Code at all and names a leaked key, an owner-level token that was never scoped down and a release check loosened for the week. The lesson in the final record is operational: keys left unrevoked and tokens without limits, not the AI tool.
The release. According to LiteLLM, the malicious litellm==1.107.0 (seven wheels) was uploaded to PyPI between 11:39:51 and 11:40:13 UTC and removed by 13:23; the Docker Hub tags v1.107.0, latest, main-latest and main-stable pointed to a compromised image from 11:46:56 to 14:20 UTC; the GHCR tags were unavailable by 13:51. The official v1.107.0 source tag on GitHub did not contain the malicious files: the artifacts were built from an attacker-controlled lookalike repository, Berri-AI/litellm. Enterprise customers pulling from the private registry were not affected. LiteLLM told users to pin 1.106.2 or earlier. A public GitHub issue (#47826), opened by a third party at 12:06 UTC, describes a credential stealer called cook.pth and a sitecustomize loader. The two accounts of the cause. The first post (21 October, last updated 20:30 UTC) says Claude Code sometimes embeds a user's GitHub CLI OAuth token in a response body and that, where response bodies are logged, the tokens appeared in LiteLLM's logs; it suspected the attacker reached an internal LiteLLM deployment. A banner added on 23 October says some assumptions there were inaccurate or incomplete and points to the canonical record. That record (23 October) says: on 27 May 2026 a configuration file with the master key of the LiteLLM Agent Platform, an internal alpha service, was committed to a public repository; the key was identified as needing revocation but was never revoked; on 10 October the attacker used it to read the platform's API, which returned the GitHub CLI token of an organization owner; with it the attacker exfiltrated the tokens of two maintainers through throwaway CI workflows (10 October), and on 21 October disabled branch protection, pointed the release workflow at the lookalike repository, approved the production gate with a second maintainer's token, deleted the run records with a third, and force-pushed the history clean. The record says release approvals had been relaxed earlier that week. The words "Claude" and "Claude Code" do not occur in it. What the record does not claim. How many installations ran the malicious version is not stated. Both accounts are LiteLLM's own. Socket's Threat Research team, in its own post of 23 October that the final account links to, reports two secret-stealing workflows that ran in the repository on 10 and 12 October, eleven days before the release, and says LiteLLM's investigation corroborates the 10 October activity; that post does not cover the release itself or the number of installations.