Poisoned LiteLLM Release Ships Credential Stealer Through PyPI and Docker

Key Takeaways

• LiteLLM 1.107.0 was published to PyPI and Docker registries with an infostealer and remote code loader.
• Attackers used stolen maintainer GitHub tokens to alter the release workflow.
• The PyPI release was live for about 1.7 hours; Docker tags were poisoned for up to 2.5 hours.
• LiteLLM says to assume exfiltration succeeded on any internet-connected host that ran it.
• This is the second LiteLLM supply-chain compromise of 2026.

The AI Gateway Shipped the Attacker's Code

LiteLLM, a widely used gateway that routes requests to many model providers, confirmed that a signed but malicious release reached PyPI and container registries. According to the LiteLLM incident report, the payload steals credentials and installs remote execution tools, putting every key the gateway holds at risk.

What We Know

On October 21, 2026, litellm 1.107.0 was available on PyPI from 11:39 to 13:23 UTC. Docker Hub and GHCR tags including latest and main-stable were compromised from 11:46 UTC until 13:51 to 14:20 UTC. The enterprise release and the official GitHub source tag were not affected. Datadog Security Labs confirmed multiple maintainer accounts were compromised.

LiteLLM said the attacker held GitHub CLI OAuth tokens, possibly harvested from logs of an internet-exposed internal deployment, and used them to override branch protections and redirect the release workflow to a lookalike repository. Temporarily expanded release permissions added the week before helped. Indicators include cook.pth, sitecustomize.py, and a daemon holding /tmp/remote_code_loader.lock. Maintainer credentials were revoked and the investigation is ongoing.

What Happened

This was a software supply-chain attack on the release pipeline, not a code vulnerability. With valid maintainer tokens, the attacker changed how releases were built and published signed artifacts that looked legitimate to every installer and image pull.

The AI angle is the target. An LLM gateway sits between applications and model providers, so it typically holds provider API keys, master keys, database passwords, and cloud role credentials. Installing a poisoned gateway hands an attacker the access for an organization's entire AI stack at once. LiteLLM also noted that AI coding agents can echo tokens into logs, a plausible route for the original credential leak.

Why It Matters

Automated dependency updates and floating Docker tags like latest mean many environments may have pulled the release without anyone choosing it. Teams must rebuild affected hosts, pin to 1.106.2, and rotate every secret the gateway could reach.

A repeat compromise of the same project, following the March 2026 LiteLLM supply-chain attack, shows attackers view AI infrastructure packages as high-value targets. Concentrated credentials make AI gateways a priority for supply-chain controls.

PointGuard AI Perspective

AI components need the same supply-chain scrutiny as any critical dependency. PointGuard AI Supply Chain Security builds an AI bill of materials across code, pipelines, and containers, so teams can find every LiteLLM instance and version within minutes of an incident like this.

PointGuard AI Security Posture Management flags gateways holding broad provider and cloud credentials and helps scope them down, limiting what a poisoned package can steal. Our blog From SBOM to AI-BOM explains why AI dependencies need their own inventory. Resilient AI adoption depends on knowing what you run and keeping the keys to your AI stack out of any single package's reach.

Incident Scorecard Details

Total AISSI Score: 7.8/10

Criticality: 8, LLM gateways hold provider keys, master keys, and cloud credentials for whole AI stacks. AISSI weighting: 25%

Propagation: 8, A poisoned package spread automatically through PyPI installs and floating Docker tags. AISSI weighting: 20%

Exploitability: 7, Malicious releases were published and installed, with exfiltration presumed on affected hosts. AISSI weighting: 15%

Supply Chain: 9, The compromise sits in a widely used open-source AI dependency and its release pipeline. AISSI weighting: 15%

Business Impact: 7, Confirmed compromise requiring rebuilds and broad secret rotation; full impact still under investigation. AISSI weighting: 25%

Sources

Third-Party Sources

• LiteLLM: Security Incident, October 21, 2026
• Datadog Security Labs: LiteLLM supply chain compromise: What you need to know

PointGuard AI Sources

• PointGuard AI Incident Tracker: LiteLLM Supply Chain Attack Exposes Cloud Secrets
• PointGuard AI Supply Chain Security
• PointGuard AI Blog: From SBOM to AI-BOM