We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

LiteLLM 1.107.0 was compromised and carried malware that steals credentials

Teams that installed the new release of this AI gateway should treat those systems as compromised and change their keys.

LiteLLM said on 21 October 2026 that its release pipeline was compromised and pushed version 1.107.0 to PyPI and the Docker registry. That version contained malware that steals credentials and loads tools to run code remotely.

Version 1.107.0 was live for a few hours on PyPI and Docker

The malicious package was on PyPI for about 2 hours, from 11:39 UTC to 13:23 UTC.

The Docker images tagged v1.107.0, latest, main-latest and main-stable were affected from 11:46 UTC to 14:20 UTC.

LiteLLM says all earlier versions are safe and the affected releases have been pulled. Customers on its private enterprise release were not affected.

The official source tag for 1.107.0 on GitHub does not contain the malicious files. They were built from a repository the attacker controlled.

When version 1.107.0 was available

  1. 11:39 UTCGlobal The malicious package goes live on PyPI
  2. 11:46 UTCGlobal The affected Docker images are compromised
  3. 13:23 UTCGlobal The package is no longer live on PyPI
  4. 14:20 UTCGlobal The Docker images are no longer compromised
Times are in UTC, as LiteLLM gives them. Earlier versions were not affected.

LiteLLM says the attacker used developer tokens taken from logs

LiteLLM believes the attacker got into an internal LiteLLM deployment. It says the attacker took GitHub tokens from its logs and used them to compromise the release workflow.

The NCSC described this kind of attack in its blog of 4 June 2026. Attackers steal credentials or tokens that let them update a trusted package.

LiteLLM tells affected users to rebuild and change their keys

If you installed version 1.107.0 or started one of those Docker images in that window, LiteLLM says to assume the system is compromised. It says to pin version 1.106.2 or another earlier explicit version.

Do not start by running pip install. Any Python start in that environment runs the malicious files again.

Reinstall version 1.106.2, or better, rebuild from scratch. If the host could reach the internet, LiteLLM says to assume the data was taken.

The NCSC also advises changing exposed keys and tokens straight away when compromise is suspected.

What LiteLLM and the NCSC advise after version 1.107.0

  • Treat any system that installed 1.107.0 or ran the affected images as compromised
  • Do not start by running pip install
  • Reinstall version 1.106.2, or better, rebuild from scratch
  • Change the keys and tokens that system could reach
A summary of the published advice. LiteLLM's notice has the full steps.

For most firms, the question is which suppliers use it

Python can run scripts as soon as a package is installed, so a bad package can act straight away, the NCSC says.

Most organisations rely on suppliers to deliver products, systems and services. Yet very few UK businesses set minimum security standards for their suppliers, according to the NCSC.

If you build software, the NCSC advises pausing automatic updates where compromise may be present. It also advises approving new versions by hand and keeping a clear list of every package you use.

If you buy software or AI services, ask your suppliers whether they used version 1.107.0. The NCSC's supply chain guidance sets out 12 principles for that conversation.

What happens next

LiteLLM says it is still confirming parts of its account and building a timeline, and will post more detail as it finds it.

Read next

Sources

  1. docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM, checked 23 October 2026
  2. NCSC, Software supply chain attacks: check your dependencies, checked 23 October 2026
  3. NCSC, Supply chain security guidance, checked 23 October 2026

This is an independent editorial guide, not legal advice.