LiteLLM 1.107.0 backdoored on PyPI and Docker: clean up right
LiteLLM 1.107.0 shipped a credential stealer and hourly backdoor via PyPI and Docker. Pin 1.106.2, delete the startup files before pip uninstall, rotate keys.
LiteLLM got hit again. On October 21, LiteLLM 1.107.0 went out on PyPI and Docker Hub with a credential stealer and an hourly remote-code backdoor baked into the official release artifacts. If you run an AI gateway built on LiteLLM and pulled latest that day, treat the host as compromised. And do not reach for pip uninstall first.
What actually happened
Per SafeDep's analysis, all seven 1.107.0 wheels were uploaded to PyPI around 11:39 UTC and stayed up until PyPI pulled them at 13:23 UTC. Docker images tagged v1.107.0, latest, main-latest and main-stable carried the same payload until about 14:20 UTC. The GitHub source and the git tag are clean. The malicious build came from a lookalike repository, Berri-AI/litellm. SafeDep, relaying LiteLLM's own incident report, says the attacker held GitHub credentials for three developers and used them to repoint the release workflow, so the official pipeline signed and published the bad build.
The package drops three files into site-packages. cook.pth runs at every Python start, even if nothing imports litellm. cook.py steals SSH keys, cloud and CI tokens, browser passwords, environment variables, and the provider keys stored in a LiteLLM proxy database, then sends them to www.litellm[.]dev. sitecustomize.py starts a daemon that checks in hourly and runs downloaded code.
Chainguard's write-up flags the trap: pip uninstall starts Python, which runs the payload again. Clean versions are 1.106.2 and the 1.107.0 release candidates.
This is a separate incident from the earlier LiteLLM PyPI compromise we covered.
Why it matters for your business
Your AI gateway holds every key you have. That is the point of LiteLLM: one proxy, all your OpenAI, Anthropic and Gemini keys in one table. The stealer went straight for that table.
Tags are not versions. latest and main-stable both pointed at the bad image. If your compose file says latest, you did not choose what you ran on October 21.
Signed is not safe. The official pipeline signed this build. Signatures prove who built it, not what went in.
Cleanup order: isolate the host, delete cook.pth, cook.py, sitecustomize.py and the /tmp lock files, kill the detached Python process, block egress to litellm[.]dev, then pin 1.106.2 by digest and rotate every credential the box could reach.
Key takeaways
- LiteLLM 1.107.0 on PyPI and Docker (including latest and main-stable tags) shipped a stealer and hourly backdoor on October 21
- The payload runs at every Python start, so delete the three startup files before running pip uninstall
- Pin litellm 1.106.2 and pin Docker images by digest, not by tag
- Rotate every provider key in your LiteLLM proxy database, plus SSH, cloud and CI credentials
- This is a new incident, separate from the earlier compromised 1.82.x releases
Not sure what your AI gateway can reach? We build LLM routing with pinned dependencies, scoped per-app keys, and egress rules, so one bad package does not empty your key vault. See how we build it, or ask us to audit your stack.
Sources: SafeDep, Chainguard.
- #litellm
- #supply-chain
- #pypi
- #ai-security
- #credential-rotation
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
GitLab CVE-2026-110264: second CVSS 10 in ten days, patch again
GitLab CVE-2026-110264 is a CVSS 10.0 unauthenticated RCE back to version 7.0. Patched for the last one on October 12? Upgrade again to 19.5.1 or your branch fix.
Read itStripe Atlas in MCP: an AI agent can start your company filing
Stripe Atlas now works through the Stripe MCP server, so an AI agent can prep a Delaware LLC or C corp application. Signing, payment, and choices stay with you.
Read it