A malicious LiteLLM release was live for about two hours on 21 October 2026. It is the clearest sign yet that AI tooling is now a prime supply chain target.
LiteLLM is a popular open-source library that lets applications talk to many large language model providers through one interface. On 21 October 2026, attackers published a malicious release, litellm 1.107.0, to PyPI and to the project's official Docker images. According to Datadog Security Labs, it was available for roughly two hours before it was pulled.
It was the second LiteLLM compromise this year, following an incident in March that affected versions 1.82.7 and 1.82.8.
What the malicious release did
Datadog's analysis describes two payloads:
- A credential stealer that runs whenever Python starts, targeting cloud keys, developer tokens, AI tool credentials, browser data and LiteLLM proxy secrets.
- A second-stage remote access trojan that gives attackers ongoing access to the machine.
The attackers reportedly got in using stolen GitHub CLI OAuth tokens from engineers' accounts, which let them trigger the project's own release workflow. In other words, the package looked official because it was published through the official pipeline.
Why AI tooling is a prime target
AI gateways and SDKs sit in a uniquely sensitive position. A single LiteLLM proxy may hold API keys for several model providers, plus access to the prompts and data flowing through it. Compromise that one component and an attacker inherits all of it.
How to protect your AI stack
- Pin exact versions with hash verification instead of floating version ranges.
- Check whether 1.107.0 was ever installed, including in CI runners and Docker images tagged latest, main-latest or main-stable during the window.
- Rotate every credential that lived on an affected machine, starting with cloud and model provider keys.
- Use trusted publishing for your own packages, and protect release workflows with short-lived tokens.
- Monitor egress from build and inference hosts, so unexpected outbound connections stand out.
Supply chain security is no longer just about operating system packages. Every model SDK, agent framework and AI gateway in your stack deserves the same scrutiny you give your web servers.
