LiteLLM said on October 21, 2026 that attackers compromised its release pipeline and pushed a malicious litellm==1.107.0 package to PyPI along with poisoned Docker tags.
According to the LiteLLM incident report, the bad PyPI release was available from 11:39 to 13:23 UTC. The affected container tags — v1.107.0, latest, main-latest, and main-stable — were exposed from 11:46 to 14:20 UTC before removal or repointing. LiteLLM also said customers using its private enterprise registry were not impacted and told users to pin 1.106.2 or another earlier explicit version.
The risk was broader than apps actively calling LiteLLM. The malicious release used cook.pth and sitecustomize.py, which let code run when the Python interpreter starts. That means an infected environment could execute the payload before an application ever imports the package. Datadog’s analysis describes the malware as a credential stealer with remote-code capability aimed at cloud, developer, browser, and AI-service secrets.
For teams that pulled the bad package or tags, this is an environment-response problem, not just a rollback: check hosts and containers for indicators of compromise and rotate reachable credentials.