LiteLLM package and container releases compromised to steal secrets
Attackers compromised LiteLLM's release process and published malicious version 1.107.0 packages and Docker images designed to steal credentials and environment variables. The affected artifacts included PyPI wheels and container images on Docker Hub and GHCR for a few hours. The maintainers said private enterprise deployments were not impacted, and security researchers detected the malicious release quickly.
LiteLLM is a community-developed Python toolkit and model-access gateway that lets applications reach multiple model providers through one interface. The project reports 61,800 GitHub stars and 92 million monthly PyPI downloads, with NVIDIA, Netflix, AT&T, and Okta among its users.
The compromised 1.107.0 release was live on PyPI for roughly 103 minutes and on Docker Hub for about 153 minutes; GHCR tags were unavailable by 13:51 UTC. The payload added three files to Python’s library directory, causing execution whenever Python started, including during investigation with pip or Python.
Because LiteLLM is widely used in AI application stacks, this incident could expose organizations’ cloud, AI-provider, developer, and browser credentials if affected environments ran the malicious release. Developers and platform teams may face urgent rotation and rebuild work, while downstream customers could be affected through compromised integrations. Quick detection may have limited exposure, but the event may reinforce scrutiny of package and container release controls.