LiteLLM 1.107.0 shipped a credential stealer to…

LiteLLM reports that its 2026-10-21 release-pipeline compromise shipped version 1.107.0 to PyPI and public container registries with credential-stealing malware; the official source tag did not contain the malicious files. Its completed investigation, published on October 23, traces initial access to an unrevoked Agent Platform master key exposed in a public repository on May 27, followed by theft of an organization owner's GitHub token and additional maintainer tokens. This supersedes LiteLLM's initial hypothesis that the attacker obtained the tokens from internal LiteLLM response logs, which had implicated Claude Code.

Why it matters

It shows how an exposed agent-orchestration credential and an unscoped GitHub organization-owner token reached a software release pipeline, and why incident records must distinguish an early hypothesis from a completed investigation.

Key facts

As stated in the sources, with where to find them.

LiteLLM reports the malicious litellm==1.107.0 wheels were live on PyPI from 11:39:51 to 13:23 UTC on 2026-10-21; the v1.107.0 tag and three floating tags on Docker Hub pointed to the compromised image from 11:46:56 to 14:20 UTC, and the GHCR tags until they were made unavailable by 13:51 UTC. It says enterprise customers on its private registry were not affected and earlier versions are safe.LiteLLM post, TLDR; Confirmed Affected Versions
LiteLLM says that after a March 2026 incident it had moved releases to a private repository with trusted publishing, immutable Docker tags and signed images. It reports that on the Monday before the release it temporarily widened release permissions, that the attacker held three developers' GitHub CLI credentials, one belonging to one of two organization owners, used them to override branch protection and point the release workflow at a lookalike repository, and used a third account to delete workflow records, limiting logs.LiteLLM post, How this happened; Timeline
LiteLLM's 2026-10-23 canonical postmortem supersedes its October 21 hypothesis about token theft from response logs. It says a master key exposed in a public repository on 2026-05-27 was identified for revocation but not revoked. On October 10 the attacker used it to access the experimental LiteLLM Agent Platform, whose API returned a GitHub organization owner's unscoped CLI OAuth token; the token was configured for cloud agents to file pull requests. The postmortem does not establish Claude Code as the cause of this credential exposure.Canonical postmortem, Narrative; GitHub Owner Access; Compromised Credentials
LiteLLM says the owner's token enabled theft of two maintainers' GitHub tokens from CI secrets on October 10, plus additional secrets from private repositories on October 12. The stolen identities were used to alter, trigger and approve the malicious release and erase workflow records. LiteLLM says it began revoking every token associated with its internal systems and vendor platforms, rather than limiting rotation to credentials it had traced.Canonical postmortem, Exfiltrating additional tokens; Building and Signing the Malicious Release; Detailed Timeline
Socket reports its AI scanner flagged the seven 1.107.0 wheels seven minutes after publication (published 11:39:51, alerts 11:46:30 UTC) and describes LiteLLM as receiving approximately 23M weekly downloads. Wiz reports approximately 49,000 downloads of the malicious version, citing ClickPy data in an update dated 2026-10-22.Socket, PyPI Wheels and Floating Container Tags; Wiz, LiteLLM Compromised
Socket and Endor Labs describe a collector with 16 modules covering cloud and deployment credentials, developer keys, browser data, environment variables and authentication files of AI coding tools including Codex, Claude, Gemini and Cursor, plus a module that queries the LiteLLM proxy's stored provider credentials and model configuration. Socket says this shows targeting, not successful access to a particular deployment.Socket, The Collector Reaches Beyond Provider API Keys; Endor Labs, What the collector takes
A second component polls a GitHub-hosted pointer hourly and would download and run remote Python without signature checks. Socket reports the pointer returned an empty body at 13:01 UTC; Wiz says it was never populated beyond test values and that GitHub took the repository down by about 13:30 UTC.Socket, A GitHub File Controls the Remote Python Loader; Wiz, Payload
Endor Labs reports the source distribution was built from the malicious revision and that the official v1.107.0 tag lacks the packaging change, so reviewing the tagged source would miss it (the source distribution carries the packaging change but not the payload files). Socket notes the container provenance records what source was used but not how the override was authorized.Endor Labs, The packaging change; Socket, The Release Workflow Recorded a Lookalike Repository
Wiz reports abuse of stolen credentials beginning about 4.5 hours after exfiltration: between 16:20 and 17:01 UTC the attacker validated AWS instance-role credentials taken from CI runners and Kubernetes nodes and listed Bedrock models, which Wiz calls consistent with LLMjacking, with IAM enumeration in a small number of environments.Wiz, Post-Exploitation Activity
Wiz assesses that the payload shows strong indications of LLM-aided development, based on code style and untested platform paths, and says the combined use of two Python startup mechanisms appears to be the first documented case in the wild. Both are Wiz's inferences.Wiz, Payload
The Hacker News reports the analyses came from SafeDep, Socket, StepSecurity and Upwind, and notes that similar startup-file behavior was seen in the March 2026 LiteLLM compromise during the TeamPCP supply-chain attacks.The Hacker News

Record updates

Oct 24, 2026 · New evidence
Added LiteLLM’s completed investigation published on 2026-10-23. It supersedes the response-log hypothesis, tracing access to an unrevoked Agent Platform master key and subsequent GitHub credential theft; Claude Code is not established as the cause.

Findings that cite this record

Jul 23, 2025

Malicious or compromised agent extensions, MCP servers, and skills have been published to public registries and used against real users.

Corroboratedobserved6 evidence records

Key questions this bears on

Where are deployed AI agents actually being exploited?Mostly around the model: connectors, credentials, tools, and packages, rather than the model alone.
How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.