Malicious LiteLLM 1.107.0 release on PyPI and Docker carried a credential stealer
A poisoned LiteLLM release on PyPI and Docker carried a credential stealer and an hourly backdoor. Affected builds, how the malware worked and how the attacker got in.
On 21 October 2026, attackers published a malicious LiteLLM 1.107.0, the popular Python library and proxy for calling AI models. It went out through PyPI and Docker images. Researchers at SafeDep, Socket, StepSecurity and Upwind reported that it carried a credential stealer and a backdoor. PyPI has quarantined the package, and the malicious Docker images have been removed.
Who is affected
According to LiteLLM’s disclosure, as reported by The Hacker News, the compromised builds were PyPI v1.107.0 and the Docker and GHCR tags v1.107.0, latest, main-latest and main-stable. Exposure windows were 11:39 to 13:23 UTC on 21 October for unpinned pip installs, and 11:46 to 14:20 UTC for pulls of those Docker images.
What the malware did
A cook.pth file made Python run the payload at interpreter start, before LiteLLM was even imported. The stealer, which calls itself “privcollect”, gathered cloud tokens, private keys, browser data, environment variables and AI tool credentials, and sent them to litellm[.]dev. On Linux and macOS, a second component checked a GitHub “dead drop” every hour for code to run. Wiz reported that the attacker started testing stolen AWS credentials about 4.5 hours after they were taken.
How it happened
LiteLLM said the attacker used stolen GitHub CLI OAuth tokens from three engineers’ accounts to disable branch protections and run the release workflow. LiteLLM suspects the tokens were exposed in logs on an internal LiteLLM deployment that was reachable from the internet. The investigation was still ongoing at the time of reporting.
Fixed version
Reports name 1.106.2 as the last known-good release and advise pinning it by digest.