LiteLLM PyPI and Docker packages compromised via stolen GitHub CLI tokens

LiteLLM, an open source proxy that routes requests to multiple large language model providers, was compromised in a supply chain attack that served malicious packages to its users on both PyPI and Docker.

The incident occurred on October 21, 2026, and involved version 1.107.0 of the popular open source proxy for routing requests across LLM providers.

What happened

According to LiteLLM's own investigation, the attackers obtained the GitHub CLI OAuth tokens for an unexpected, innocuously named user account in an internal LiteLLM deployment that was exposed to the public internet.

The tokens were likely leaked by Claude Code, which, in specific circumstances, would embed them into a response body that could be logged to LiteLLM logs, and the attackers likely retrieved the tokens from those logs.

It is still unclear how the attackers accessed the internal deployment or moved laterally, as they had access to three sets of developer GitHub CLI credentials, LiteLLM says.

Using the compromised credentials, the attackers disabled branch protections, merged a change that pointed the releaser to a different source repository, and ran a compromised GitHub workflow that pointed to a lookalike repository, then signed and published the poisoned artifacts.

The malicious packages were online for roughly three hours and are estimated to have been downloaded over 49,000 times.

Impact

Users who downloaded the malicious LiteLLM version 1.107.0 packages during the compromise window were infected with malware that serves as an information stealer and a RAT.

Once a Python interpreter loaded the stealer, it harvested system information, browser credentials and cookies, developer credentials, environment variables, cloud secrets from AWS, GCP and Azure, AI tool API keys for Anthropic, GitHub Copilot and OpenAI, SSH private keys, shell history files, and GPG keys.

The stolen data was encrypted and sent to a lookalike domain, litellm.dev.

Security firm Wiz said the attackers started abusing the stolen credentials roughly 4.5 hours after they were exfiltrated and observed the attackers querying Amazon Bedrock models with stolen AWS credentials, suggesting LLMjacking.

The RAT component of the malware was observed regularly checking with the attackers' command-and-control server, and security firm StepSecurity said it checks a GitHub dead drop every hour and runs whatever Python the attacker serves.

LiteLLM said its enterprise customers pulling from its private repository were not affected.

Response

The malicious packages were removed from PyPI, and Docker Hub tags and image variants were either removed or repointed to clean artifacts.

LiteLLM said users who installed version 1.107.0 should immediately remove it, rotate their credentials, and sweep their systems for malware, pointing to version 1.106.2 as the most recent clean release.

Lessons for security leaders

This case shows how a single internally exposed tool, and a developer credential swept into a log file, can cascade into a signed, publicly distributed package compromise within hours. Software that concentrates API keys and cloud credentials for many providers, such as an AI gateway or proxy, is an especially high-value target because one compromised release can expose secrets across cloud, AI and developer environments at once. Security teams should audit what internal services are reachable from the public internet, treat tokens that pass through AI tool logging pipelines as sensitive, and have a rapid credential-rotation and artifact-verification plan ready before a build or release pipeline is ever compromised.