Key points
- Version 1.107.0 contained malware that ran automatically upon Python startup.
- Attackers used stolen GitHub credentials from three developer accounts to redirect the build process.
- The malicious package was available on PyPI and in Docker images for roughly two hours.
What we know
LiteLLM version 1.107.0 was compromised on October 21, with the malicious code distributed via PyPI and official Docker images tagged latest, main-latest, and main-stable. According to cybersecurity firm Aikido, the bundled files executed automatically when Python started, even if an application did not import LiteLLM. The malware collected cloud credentials and API keys from LiteLLM’s database, potentially granting attackers access to other services. It also included a remote access trojan that fetched and executed code from attacker-controlled servers every hour.
LiteLLM stated that attackers used stolen GitHub credentials associated with three developer accounts to manipulate the release pipeline, redirecting it to a lookalike repository. The company noted that credentials may have been obtained from logs of an internet-facing internal deployment or through Claude Code responses that exposed GitHub tokens. Although the malicious packages were removed from PyPI after approximately two hours and Docker images were withdrawn later that day, LiteLLM advised treating environments as potentially breached. The company confirmed that customers using its private enterprise registry were unaffected. No patch has been confirmed yet for the compromised version.
Defender's checklist
- Verify if version 1.107.0 was installed or pulled during the October 21 exposure window.
- Check for active background processes fetching code from unknown infrastructure every hour.
- Inspect LiteLLM database logs for unauthorized access to API keys or cloud credentials.
- Review GitHub authentication token exposure in Claude Code responses recorded by LiteLLM.
What analysts watch for
Teams usually examine package metadata for unexpected changes in build signatures or repository redirects. Analysts check whether automated scripts execute on interpreter startup without explicit imports, a common tactic in supply chain attacks. They monitor for outbound connections to newly registered domains or IP addresses that persist after initial installation. Persistence mechanisms often involve scheduled tasks or cron jobs that retrieve additional payloads. Investigators also review environment variables and configuration files for injected credentials or modified paths. This behavior helps distinguish malicious packages from legitimate updates.
What to do and how to stay safe: LiteLLM
- Rotate all API keys and cloud credentials stored in LiteLLM’s database immediately.
- Rebuild Docker containers using verified base images and avoid pulling from latest tags until confirmed safe.
- Monitor network traffic for hourly outbound connections to unknown servers that may indicate active remote access trojans.
- Audit GitHub repository access logs for unauthorized changes to release workflows or redirects to lookalike repositories.
Step-by-step guide: Account Takeover: Definition, Vectors, and Defense Strategies
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which LiteLLM version was compromised?
Version 1.107.0 was the compromised release distributed on October 21.
How did the malware execute without being imported?
Files bundled with the package executed automatically when Python started, regardless of application imports.
Were enterprise customers affected?
LiteLLM stated that customers using its private enterprise registry were unaffected by the incident.
