LiteLLM Python Package Compromised in Supply Chain Attack Targeting AI Developer Credentials

A popular AI development tool has been weaponized against the very developers who trust it most — and the attackers used stolen GitHub tokens to do it.

The LiteLLM Python package version 1.107.0 was compromised in a sophisticated software supply chain attack that deployed a credential stealer and a persistent backdoor, according to reports published October 21, 2026 by security firms SafeDep, Socket, StepSecurity, and Upwind. The package has since been quarantined on the Python Package Index (PyPI) and malicious Docker images have been removed from public registries.

LiteLLM is widely used by AI developers to manage interactions across multiple large language model APIs. Its compromise represents a significant threat to the broader AI development ecosystem — an industry already grappling with rapidly expanding attack surfaces as AI tooling becomes embedded in enterprise infrastructure.

---

How the Attack Unfolded

The threat actor gained entry through stolen GitHub CLI OAuth tokens belonging to three engineers associated with the LiteLLM project. Oliver Jensen, director of security at LiteLLM, confirmed the breach in a public statement.

"We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," Jensen said. "The threat actor used one user's account to trigger the project-releaser run and another user's account to approve it. All tokens which were involved in this attack have been revoked."

Jensen added that the mechanism by which the tokens were originally stolen remains under investigation. "We have not yet identified the mechanism by which the threat actor acquired the relevant tokens so cannot yet assert that no further access to these GitHub accounts," he said. As a precautionary measure, LiteLLM removed all but one unaffected user from its GitHub organization.

The attack bears a striking resemblance to a previous incident involving LiteLLM — one connected to the TeamPCP supply chain attacks that occurred earlier in March 2026. Both attacks used the same technique of embedding malicious code through a Python path file called "cook.pth." The recurrence of this method across two separate incidents suggests a deliberate and targeted campaign against the LiteLLM project rather than an opportunistic intrusion. Understanding the data security risks within modern software supply chains is increasingly essential for any organisation that relies on open-source tooling.

A Pattern Worth Noting

The reuse of the same technical mechanism — the "cook.pth" path file injection — across two incidents months apart points to either the same threat actor or a well-documented playbook being replicated. Security teams should treat this pattern as a signal that LiteLLM and similarly positioned AI packages remain active targets. The broader implications of these attacks are explored further in the context of supply chain security and business continuity planning, where the downstream consequences of a single compromised package can ripple through entire enterprise operations.

---

What the Malware Does

The malicious version 1.107.0 is equipped with two primary payloads. The first is a credential harvester that calls itself "privcollect." The second establishes a persistent backdoor that operates as a background daemon.

"The first payload is a credential stealer that calls itself privcollect," StepSecurity noted in its analysis. "The second payload forks a background daemon that checks a GitHub dead drop every hour and runs whatever Python the attacker serves."

How the Malware Activates

The malware activates before LiteLLM is even imported. The "cook.pth" path file contains a single line — "import cook" — which triggers the credential collector the moment the Python interpreter starts. This design makes the malware particularly difficult to detect because it operates at the interpreter level rather than within the application itself. Most conventional security scanning tools focus on application-layer behaviour, meaning this infection method can persist undetected through standard code reviews and dependency audits.

For context on how this class of threat fits into the wider landscape, the range of malware types used in modern cyberattacks continues to expand, with supply chain-targeted variants becoming increasingly sophisticated in how they evade detection.

What Data Is Targeted

Once active, the stealer targets a broad range of sensitive assets:

• Cloud tokens and credentials
• Developer account credentials and private keys
• AI tooling credential JSON files
• Browser data from Chromium and Firefox
• Environment variables
• LiteLLM proxy configurations and saved model credentials

All harvested data is packaged into a GZIP-compressed TAR archive and transmitted to "litellm[.]dev/healthcheck" via an HTTP POST request. The backdoor separately reads a file called "domain.txt" from a GitHub repository to receive further instructions and execute additional payloads served remotely. That repository currently returns a 404 error.

Scope of Affected Builds

The affected wheels span multiple operating systems and processor architectures, including macOS, Linux, and Windows builds. The source distribution "litellm-1.107.0.tar.gz" contains no payload files but includes a tampered "pyproject.toml" file — a detail worth noting because it means source-level inspection alone would not reveal the full extent of the compromise.

---

Immediate Steps for Affected Users

Security researchers and LiteLLM itself have issued clear guidance for anyone who downloaded version 1.107.0. Users are advised to treat all credentials present on affected systems as fully compromised — without exception and regardless of whether suspicious activity has been observed.

Credential and Package Actions

• Revoke and replace all cloud credentials, API keys, and private keys from a clean environment unconnected to affected systems
• Pin the package to version 1.106.2 by digest until a verified clean release is confirmed
• Audit browser data and environment variables on any machine where the malicious version was installed or executed
• Review GitHub OAuth token activity if the affected systems had access to any GitHub organization resources

LiteLLM has also updated public registries to sever trusted links to its GitHub organization in order to prevent further publication of malicious packages.

Longer-Term Security Posture

This attack is a sharp reminder that software supply chain threats are no longer a peripheral concern. As the AI development ecosystem matures and packages like LiteLLM become critical infrastructure for enterprise teams, they represent high-value targets carrying enormous lateral access potential. The attack's ability to harvest AI tooling credentials specifically — not just generic cloud tokens — signals that threat actors are adapting their strategies to follow developers directly into the AI stack.

The CISA Secure Software Development Framework offers a practical reference point for organisations looking to harden their software procurement and development pipelines against exactly this class of threat.

Organisations can act on this information in three concrete directions. First, open-source AI development packages should be subject to digest-based version pinning as standard policy rather than relying on floating version numbers. Second, security teams should audit which packages have access to cloud credentials and AI API keys and enforce least-privilege principles at the environment level. Third, developers should treat GitHub OAuth tokens with the same sensitivity as passwords — enabling token expiration policies and anomaly detection on CI/CD pipelines to catch unauthorised approvals before malicious releases ship.