LiteLLM supply chain compromise: What you need to know

On October 21, 2026, a malicious version (1.107.0) of the popular Python package litellm was published to PyPI and Docker registries via a compromised build pipeline. Attackers used stolen GitHub CLI OAuth tokens to publish the package from a malicious fork, Berri-AI/litellm, which dropped persistent malware files that execute on every Python startup. The payload included a credential stealer exfiltrating cloud, developer, AI, and browser credentials, and a backdoor capable of downloading and executing remote code. The malicious release was available for approximately two hours before removal.

AI-extracted · verify before operational use