# LiteLLM 1.107.0 was compromised and carried malware that steals credentials

Teams that installed the new release of this AI gateway should treat those systems as compromised and change their keys.

The Assurance Desk, news. Published 23 October 2026.

LiteLLM said on 21 October 2026 that its release pipeline was compromised and pushed version 1.107.0 to PyPI and the Docker registry. That version contained malware that steals credentials and loads tools to run code remotely ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

## Version 1.107.0 was live for a few hours on PyPI and Docker

The malicious package was on PyPI for about 2 hours, from 11:39 UTC to 13:23 UTC ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

The Docker images tagged v1.107.0, latest, main-latest and main-stable were affected from 11:46 UTC to 14:20 UTC ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

LiteLLM says all earlier versions are safe and the affected releases have been pulled. Customers on its private enterprise release were not affected ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

The official source tag for 1.107.0 on GitHub does not contain the malicious files. They were built from a repository the attacker controlled ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

**When version 1.107.0 was available**

- 11:39 UTC, Global: The malicious package goes live on PyPI
- 11:46 UTC, Global: The affected Docker images are compromised
- 13:23 UTC, Global: The package is no longer live on PyPI
- 14:20 UTC, Global: The Docker images are no longer compromised

Times are in UTC, as LiteLLM gives them. Earlier versions were not affected.

Source: docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM, https://docs.litellm.ai/blog/security-incident-oct-21-2026 (checked 23 October 2026)

## LiteLLM says the attacker used developer tokens taken from logs

LiteLLM believes the attacker got into an internal LiteLLM deployment. It says the attacker took GitHub tokens from its logs and used them to compromise the release workflow ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

The NCSC described this kind of attack in its blog of 4 June 2026. Attackers steal credentials or tokens that let them update a trusted package ([NCSC, Software supply chain attacks: check your dependencies](https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies), checked 23 October 2026).

## LiteLLM tells affected users to rebuild and change their keys

If you installed version 1.107.0 or started one of those Docker images in that window, LiteLLM says to assume the system is compromised. It says to pin version 1.106.2 or another earlier explicit version ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

Do not start by running pip install. Any Python start in that environment runs the malicious files again ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

Reinstall version 1.106.2, or better, rebuild from scratch. If the host could reach the internet, LiteLLM says to assume the data was taken ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

The NCSC also advises changing exposed keys and tokens straight away when compromise is suspected ([NCSC, Software supply chain attacks: check your dependencies](https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies), checked 23 October 2026).

**What LiteLLM and the NCSC advise after version 1.107.0**

- Treat any system that installed 1.107.0 or ran the affected images as compromised
- Do not start by running pip install
- Reinstall version 1.106.2, or better, rebuild from scratch
- Change the keys and tokens that system could reach

A summary of the published advice. LiteLLM's notice has the full steps.

Source: docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM, https://docs.litellm.ai/blog/security-incident-oct-21-2026 (checked 23 October 2026); NCSC, Software supply chain attacks: check your dependencies, https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies (checked 23 October 2026)

## For most firms, the question is which suppliers use it

Python can run scripts as soon as a package is installed, so a bad package can act straight away, the NCSC says ([NCSC, Software supply chain attacks: check your dependencies](https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies), checked 23 October 2026).

Most organisations rely on suppliers to deliver products, systems and services. Yet very few UK businesses set minimum security standards for their suppliers, according to the NCSC ([NCSC, Supply chain security guidance](https://www.ncsc.gov.uk/collection/supply-chain-security), checked 23 October 2026).

If you build software, the NCSC advises pausing automatic updates where compromise may be present. It also advises approving new versions by hand and keeping a clear list of every package you use ([NCSC, Software supply chain attacks: check your dependencies](https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies), checked 23 October 2026).

If you buy software or AI services, ask your suppliers whether they used version 1.107.0. The NCSC's supply chain guidance sets out 12 principles for that conversation ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026) and [NCSC, Supply chain security guidance](https://www.ncsc.gov.uk/collection/supply-chain-security), checked 23 October 2026).

## What happens next

LiteLLM says it is still confirming parts of its account and building a timeline, and will post more detail as it finds it ([docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026), checked 23 October 2026).

## Read next

- [Cyber security: the section](https://theassurancedesk.com/cyber-security)
- [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check)
- [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down)
- [What to ask an AI supplier before you buy](https://theassurancedesk.com/guides/what-to-ask-ai-supplier-before-you-buy)
- [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident)

## Sources

- docs.litellm.ai, Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised, liteLLM: https://docs.litellm.ai/blog/security-incident-oct-21-2026 (checked 23 October 2026)
- NCSC, Software supply chain attacks: check your dependencies: https://www.ncsc.gov.uk/blogs/software-supply-chain-attacks-check-your-dependencies (checked 23 October 2026)
- NCSC, Supply chain security guidance: https://www.ncsc.gov.uk/collection/supply-chain-security (checked 23 October 2026)

This is an independent editorial guide, not legal advice.

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.