The company said the compiled malware stole credentials and loaded remote-code-execution tools. Earlier LiteLLM versions were described as safe, and the affected artifacts were removed.
All seven PyPI wheels for litellm==1.107.0 were live from 11:39:51 to 13:23 UTC. Docker Hub tags v1.107.0, latest, main-latest, and main-stable pointed to a compromised image index from 11:46:56 to 14:20 UTC; equivalent GHCR tags were also affected. LiteLLM says its private enterprise registry was not affected and advises exposed users to rebuild environments, pin to 1.106.2 or an earlier explicit version, and rotate reachable credentials.
The report says the official GitHub v1.107.0 source tag did not contain the malicious files and that artifacts were built from an attacker-controlled repository. It does not establish the number of users or systems compromised, the attacker identity, or the extent of credential exfiltration. Source: https://docs.litellm.ai/blog/security-incident-oct-21-2026