LiteLLM release pipeline compromised; version 1.107.0 on PyPI and Docker carried credential-stealing malware for about two hours

LiteLLM said its release pipeline was compromised early on October 21 and pushed v1.107.0 to PyPI and Docker registries with malware that steals credentials and loads remote code execution tools; the PyPI package was live from about 11:39 to 13:23 UTC and Docker tags including v1.107.0 and latest were tainted from 11:46 to 14:20 UTC ^[1]. Microsoft's analysis says the malware runs automatically via Python startup mechanisms and collects developer, cloud, browser, SSH and environment credentials, and that, per LiteLLM maintainers, stolen developer GitHub credentials were used to redirect the release workflow to a lookalike repository ^[2]. Anyone who installed 1.107.0 or ran affected images should treat the environment as compromised: delete cook.pth, cook.py and sitecustomize.py from the shell, kill the daemon, reinstall pinned litellm==1.106.2 and rotate every key the host could reach ^[1].

Industries mainly affected: Technology, Cross-industry

1. Check your version with pip show litellm and search for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py ^[1].