# Poisoned LiteLLM 1.107.0 shipped a credential stealer to PyPI and Docker for under three hours

Source: https://startwithidentity.com/blog/2026-10-21-poisoned-litellm-1-107-0-shipped-a-credential-stealer-to-pypi-and-docker/
Last updated: 2026-10-21
License: content by Start with Identity. Cite the source URL.

---

LiteLLM disclosed on October 21 that attackers had compromised its release workflow and published `litellm==1.107.0`, an AI gateway package, containing a credential stealer and a backdoor. The seven PyPI wheels were live from 11:39 to 13:23 UTC, and the `v1.107.0`, `latest`, `main-latest` and `main-stable` tags on Docker Hub pointed to a compromised image from 11:46 to 14:20 UTC; GHCR tags were affected until 13:51 UTC. The artifacts were built from a lookalike repository, `Berri-AI/litellm`, so the official source tag is clean. The Hacker News, citing Wiz, reported that a `cook.pth` file collected cloud, browser, developer and AI tool secrets, and that about 4.5 hours later the attacker tested AWS instance role credentials from compromised CI runners and Kubernetes nodes, then queried Bedrock. Enterprise customers on LiteLLM's private registry were not affected.

## Why it matters

An AI gateway holds every provider key an organization uses, plus its cloud role, so a poisoned gateway release is a bulk theft of [non-human identities](https://startwithidentity.com/guides/fundamentals/what-is-non-human-identity/). The first thing the attacker did with the loot was call `sts:GetCallerIdentity`, which is a cheap signal you can alert on.

If 1.107.0 ran anywhere with outbound internet, LiteLLM says to assume exfiltration. Do not run `pip` first: remove `cook.pth`, `cook.py` and `sitecustomize.py` from site-packages, kill the daemon holding `/tmp/remote_code_loader.lock`, rebuild images, and pin to 1.106.2. Then rotate the instance role, every provider key in the proxy database, master and virtual keys and the database password, following a [secrets rotation](https://startwithidentity.com/glossary/secrets-rotation/) runbook. Pin images by digest, not tag. LiteLLM gateways were also in our September post on [the example admin key](https://startwithidentity.com/blog/2026-09-10-litellm-gateways-still-accept-the-example-admin-key/).

Source: [LiteLLM](https://docs.litellm.ai/blog/security-incident-oct-21-2026)