LiteLLM Investigates GitHub Token Exposure After Malicious Package Release
LiteLLM said attackers got around several security controls to publish a malicious Python package that included credential-stealing and backdoor code. The release pipeline was compromised on October 21, 2026, pushing version 1.107.0 to Docker Hub and PyPI around 4 a.m., and the company suspects a GitHub token leak in AI gateway logs.
LiteLLM is looking into whether a GitHub token that appeared in AI gateway logs let intruders compromise how software releases are produced. According to the company, the attackers got past multiple safeguards before a harmful Python package was published.
The affected build process sent version 1.107.0 to Docker Hub and PyPI at about 4 a.m. on October 21, 2026. The package included code meant to steal credentials and provide backdoor access.
The incident could affect developers and organizations that rely on LiteLLM or install Python packages from public repositories. If credentials were stolen, downstream systems and cloud accounts may face unauthorized access, while backdoor code could give attackers persistent entry. Because such packages are often pulled automatically into build and AI workflows, the event may prompt more scrutiny of release tokens, log handling, and package provenance across the software supply chain.