LiteLLM 1.107.0 Compromised via Stolen GitHub Tokens, Distributing Credential Stealer

Attackers compromised the LiteLLM Python package by publishing a malicious version 1.107.0 that installs a credential stealer and a remote access trojan. According to reports from SafeDep, Socket, StepSecurity, and Upwind, the threat actor distributed the trojanized software through PyPI wheels and Docker images. The malicious release was distributed recently, exploiting stolen access credentials to bypass standard publication controls.

The malware executes before the LiteLLM library is imported, using a Python path file named cook.pth. This file triggers code execution when the Python interpreter starts. The first payload, identified by StepSecurity as privcollect, collects cloud credentials, private keys, browser data, and authentication files for AI development tools. The second payload forks a background daemon that checks a GitHub dead drop every hour to run arbitrary Python code served by the attacker.

Attack Vector and Response

Oliver Jensen, director of security at LiteLLM, stated that the investigation is ongoing. He confirmed that the malicious actions were taken through three engineers' GitHub accounts. The threat actor appeared to use stolen GitHub CLI OAuth tokens to execute the attack. One user's account triggered the project-releaser run, while another user's account approved it. All tokens involved in the attack have been revoked.

Jensen noted that the mechanism by which the threat actor acquired the relevant tokens has not yet been identified. Consequently, the team cannot assert that no further access to these GitHub accounts remains. As a temporary mitigation, LiteLLM removed all but one unaffected user from its GitHub organization. The company also updated public registries to remove trusted links to its GitHub organization to prevent further publication of malicious packages.

Impact and Detection

The compromised package affects multiple wheel files for version 1.107.0, including builds for macOS, Linux, and musl environments. The tarball also contained a tampered pyproject.toml file. PyPI quarantined the trojanized version within hours of its detection. The malicious Docker image, litellm/litellm:1.107.0, was removed from both Docker Hub and GitHub Container Registry soon after.

Security researchers advise that anyone who ran the compromised package should assume their secrets have been stolen. Ilyas Makari, a malware hunter at Aikido Security, recommended checking for specific files to determine if the malware executed. Users should look for /tmp/.pc_once_* to see if exfiltration has fired, and /tmp/remote_code_loader.lock to check if the command-and-control daemon is running or has run.

What should you do?

Organizations using LiteLLM should verify they are not running version 1.107.0. Security teams should review their environments for the indicators of compromise mentioned above. As Threat Times reported on 2026-10-21, this incident follows an earlier compromise in March that potentially exposed more than 2,500 organizations. Users should also ensure their GitHub CLI tokens are rotated and that multi-factor authentication is enforced on all accounts with repository access.

Background: OAuth

The difference between OAuth and API key lies in identity and scope. An API key acts as a static password identifying a project or client to a system. OAuth is an authorization framework that allows third-party applications to obtain limited access to user accounts without exposing credentials.

Read the full guide: Difference Between OAuth and API Key and How to Choose

What to do and how to stay safe: LiteLLM

• Audit your Python environments and Docker containers to ensure no instances of LiteLLM version 1.107.0 are installed or running.
• Check systems that may have executed the package for the presence of /tmp/.pc_once_* and /tmp/remote_code_loader.lock files to detect malware activity.
• Rotate all cloud credentials, API keys, and private keys that were accessible to any system where the compromised package might have been installed.
• Review GitHub organization permissions and enforce strict access controls, including multi-factor authentication, for all accounts with release capabilities.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How did the attacker publish the malicious LiteLLM package?

The attacker appeared to use stolen GitHub CLI OAuth tokens from three engineers to trigger and approve the malicious release.

What does the malware in LiteLLM 1.107.0 do?

It installs a credential stealer that collects cloud and AI keys, and a backdoor that checks for remote commands hourly.

Has the malicious package been removed from public registries?

Yes, the package has been quarantined on PyPI and the malicious Docker images have been removed from Docker Hub and GHCR.