LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
- Product
- litellm
- Affected
- litellm 1.107.0
- Fixed in
- No fix yet
Last verified against sources: October 26, 2026
Am I affected?
litellm: affected litellm 1.107.0. No fix has been reported yet.
- Check your version: run
pip show litellm. Versions 1.107.0 of litellm are affected. [1]
What to do now
- Remove the package if it is installed: run
pip uninstall litellm. [1] - Stop deploying LiteLLM 1.107.0 and investigate environments where Python ran after installation, including proxy containers and CI runners. [1]
- No patched version is available for pypi/litellm 1.107.0. [1]
General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.
What happened
- A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys. [1]
- LiteLLM version 1.107.0 contains malicious Python startup files that collect cloud credentials, private keys, browser data, and authentication files for AI development tools. [1]
- The provenance attached to the Linux amd64 image identifies the private BerriAI/project-releaser workflow, run 39587059944, and source revision 20535d8fa11f786a6c24df7488a0e449ed5f09ad. [1]
Impact
- A compromised installation can therefore run alongside provider API keys, cloud identities, and database connection strings. [1]
- Once the files are installed, a normal Python startup can activate them without the application importing LiteLLM. [1]
- Deployments following a floating tag could therefore receive the affected release without explicitly selecting 1.107.0. [1]
- One module specifically targets LiteLLM deployments with DATABASE_URL configured. [1]
What was done
- The source lists pypi/litellm affected 1.107.0 patched none. [1]
Sources
- news:socket:socket:8dd940e88f3d1ac2 — Socket
Every statement above was checked against these sources before publishing. Spotted an error? Tell us and we will correct it with a dated note.
Share advisory brief with your team
Copy a plain-text summary for Slack, GitHub issues, or team security channels.
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
Product: litellm | Affected: litellm 1.107.0 | Fixed in: No fix yet
Summary: A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.
Source & remediation on AgentArmorHQ: https://agentarmorhq.com/incidents/2026/10/news-socket-socket-8dd940e88f3d1ac2-litellmCorrections
Report an error or request a correction. We review requests within 5 business days and add a dated correction note.
Discussions for litellm
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.