LiteLLM release pipeline pushed malicious package

LiteLLM said attackers compromised its release process on 21 October 2026 and published version 1.107.0 to PyPI, Docker Hub and GHCR. It said users who pulled unpinned installs or the listed container tags within specific windows were affected.

The package was said to include code that gathered secrets and sent them out, then could load and execute further Python code from a remote server. The article described the release as a remote access trojan and said the stolen data covered system, browser, developer, cloud and AI tool secrets.

Aikido researcher Ilyas Makari said the malware used a .pth file and a sitecustomize.py file to start a background process that repeatedly checked GitHub for a current command-and-control domain. Wiz said the GitHub text file used for that purpose held only test values before GitHub removed it.

LiteLLM said it had already hardened its release process after a similar incident in March, but later opened release access for two internal engineers to publish bugfix backports. It said the attacker used three sets of developer GitHub CLI credentials, including one with workflow permissions, then disabled branch protections with an owner token and pushed the altered code through a workflow that pointed at a lookalike repository.

LiteLLM also said it found a public internal deployment with an unexpectedly named user account and suspected that the attacker used that system to obtain GitHub CLI OAuth tokens from logs. The company said it was still unclear how that deployment became public, while Socket said there was no evidence yet tying the case to the March attack.