Poisoned LiteLLM 1.107.0: check installs and rotate keys

On 21 October 2026, attackers used stolen developer access to push a bad copy of LiteLLM 1.107.0 through the project's own release process. It landed on the public Python package index and in official Docker images. The bad release steals passwords, cloud keys, and AI provider keys from the machine that runs it. It can also try to fetch more code later.

You are affected only if you installed litellm 1.107.0, or ran the Docker tags v1.107.0, latest, main-latest, or main-stable, during a short window that day. PyPI had the bad package from 11:39 to 13:23 UTC. Docker Hub tags stayed bad until 14:20 UTC. GitHub container tags were unavailable by 13:51 UTC. Older versions are safe. LiteLLM says customers of its private enterprise registry were not hit.

The bad files were removed from the registries the same day. That does not clean a machine that already ran them. Wiz reported that stolen Amazon Web Services credentials were used later that day, including identity checks and listing of AI models. Treat any machine that ran the bad release as compromised.

The bad code runs when Python starts, even if your app never calls LiteLLM. Starting Python again, including with pip, can run it again. Uninstalling is not enough on its own. The extra files stay in the Python environment until you remove them or rebuild.

• Check laptops, servers, and build machines for litellm 1.107.0, and for those Docker tags pulled on 21 October.
• If you find one, take that machine off the network before you clean it. Do not start by running pip.
• Rebuild the Python environment or container from scratch. Pin litellm to 1.106.2, or another version published before 21 October. Pin image digests, not tags like latest.
• From a clean machine, rotate cloud keys, AI provider keys, database passwords, and SSH keys that the affected machine could reach. Include every provider key stored in a LiteLLM proxy database.
• Check cloud logs for use of those keys from outside your own systems. Also look for connections to litellm.dev. The real project site is litellm.ai.
• If you never installed 1.107.0 and did not pull those image tags that day, you do not need to rotate keys for this incident. Still pin versions so a future bad release cannot install itself on its own.