In this article
If your company has an AI application, chatbot or internal tool that connects to models such as GPT, Claude or Gemini, ask your tech team today one question: did any server, laptop or build pipeline install LiteLLM version 1.107.0 on October 21, 2026? That release was published by attackers and stayed on PyPI for about two hours, between 2:39 pm and 4:23 pm Riyadh time, and it was downloaded about 49,000 times. It steals cloud keys, AI provider keys, database passwords and SSH keys. If the answer is yes, uninstalling it is not enough: rebuild the machine from a clean image and rotate every key it could reach. The safe version is 1.106.2.
What exactly happened?
LiteLLM is an open-source library and gateway that lets one application talk to dozens of AI models through a single interface, which is why many companies put it at the centre of their AI products. According to Chainguard, it had more than 100 million downloads on PyPI in the last month, and more than 2,000 other packages depend on it, so many teams install it without knowing.
According to LiteLLM's official incident report, the attackers obtained GitHub access tokens that had leaked into the project's logs. At 10:08 UTC on October 21 they used a privileged developer credential to bypass branch protection and change the release workflow so it built from a lookalike repository, «Berri-AI/litellm» instead of «BerriAI/litellm». At 11:39 UTC the malicious files reached PyPI, and at 11:46 UTC poisoned Docker images went out under the tags v1.107.0, latest, main-latest and main-stable. PyPI removed the release by 13:23 UTC, and the Docker tags were cleaned at 14:20 UTC, which is 5:20 pm in Riyadh.
This is the second attack on the same project this year. Chainguard notes that in March 2026 a group used a stolen PyPI token to publish versions 1.82.7 and 1.82.8.
What does the malicious version steal?
The dangerous part is that it does not wait for your application to use LiteLLM. The release added Python startup files that run every time Python starts on that machine, even for an unrelated command. According to Wiz's analysis, the stealer collected:
- Cloud keys for AWS, Google Cloud and Azure, from configuration files, environment variables and server metadata.
- API keys for OpenAI, Anthropic, Cohere and other AI providers, meaning your bill and your data.
- SSH private keys, shell history and saved browser passwords and cookies.
- Up to 500 provider credentials stored in the LiteLLM Proxy database.
The attackers did not sit on what they stole. Wiz saw stolen AWS credentials being tested about 4.5 hours after they were taken, from build servers and Kubernetes nodes. The malware also installed a second stage that fetches remote code every hour, so the machine stays open even after the package is removed.
Is my company affected?
You are probably not affected if your team pins exact versions and did not update between 2:39 pm and 5:20 pm Riyadh time on October 21. You may be affected if any of the following applies:
- A server or container runs «pip install litellm» without a fixed version, or pulls the Docker tag «latest».
- A CI/CD pipeline rebuilt that afternoon.
- A developer tried LiteLLM on their laptop that day.
- Your system uses another package that depends on LiteLLM.
LiteLLM says customers on its private Enterprise release were not affected.
Five steps to take today
- Search: look for version 1.107.0 in lock files, build logs and container images, and for the files cook.pth and sitecustomize.py in the Python packages folder.
- Rebuild: if you find it, do not settle for uninstalling. The official report warns that running pip inside an infected environment can trigger the malware again. Rebuild the machine or container from a clean image.
- Rotate every key: cloud keys and roles, AI provider keys, database passwords and SSH keys the machine could reach. Assume they are already in the attackers' hands.
- Review the logs: check cloud activity since October 21 for unusual calls such as GetCallerIdentity, and watch your AI provider bill for spending you do not recognise.
- Pin versions: install litellm==1.106.2 or an official later fix, and pin every library with a lock file instead of pulling «latest» automatically.
If you read our earlier article on forgotten keys in AI agent code, the lesson is the same from another angle: AI keys are now among the most valuable secrets in your company, and wherever they are gathered becomes a target.
The Origami view
Nobody hacked LiteLLM's code itself here. The attackers changed the way it is built and published, so reviewing source code alone would not have caught it. That is why protecting AI products is not about choosing a library but about how you run it: fixed versions, a separate key for each environment with only the permissions it needs, spending limits at every AI provider, and a clear record of who can reach what. When we build AI systems for companies at Origami, we treat the model gateway as the most sensitive part of the system, because it holds the keys to everything. If you want your AI application checked for this incident, or its keys and permissions reorganised, contact us.
Sources
Frequently asked questions
How do I know if my company installed the hacked LiteLLM version?
Ask your team to search lock files, build logs and container images for litellm 1.107.0, and the Python packages folder for cook.pth or sitecustomize.py. The risk window was October 21, 2026, from 2:39 pm to 5:20 pm Riyadh time.
Is uninstalling the package enough?
No. The malware runs on every Python start and installs a second stage that fetches code every hour. Rebuild the machine or container from a clean image, then rotate every key it could reach.
Which LiteLLM version is safe?
LiteLLM recommends pinning to 1.106.2 or earlier. Customers of its private Enterprise release were not affected, according to the official incident report.
We do not use LiteLLM directly. Can we still be affected?
Yes. More than 2,000 packages depend on LiteLLM, so it may have been installed as a dependency of another library. Check your full dependency list, not only what you installed yourself.
Follow Origami in Google
Pin Origami as a preferred source and our articles will surface first for you in Google Search and Top Stories.
