What happened
In the early morning of Oct 21 the LiteLLM release pipeline was compromised and pushed v1.107.0 to PyPI and Docker Hub/GHCR. The version contained compiled malware (credential stealer + RCE loader). PyPI wheels were live for ~1h44m and Docker images for ~2h34m before being pulled; prior versions are safe. The vendor's incident post confirms the artifacts were built from an attacker-controlled repository using stolen GitHub CLI OAuth tokens from three engineers (confirmed 2026-10-21, verified by fetching the primary incident page).
Why it matters
LiteLLM sits in the credential plane of most LLM deployments — it holds provider API keys and proxies every model call. A compromised proxy release gives attackers the keys to every downstream AI service plus RCE on the gateway host, a full takeover of the AI infrastructure's identity layer. This is exactly the 'AI supply-chain at runtime' scenario with a confirmed malicious release.
Attack vector
Supply-chain: attackers used three stolen maintainer GitHub accounts / GitHub CLI OAuth tokens to modify the release pipeline and publish attacker-built wheels and images containing compiled malware that steals credentials and loads remote-code-execution tooling on every Python start (via cook.pth / sitecustomize.py).
Affected systems
LiteLLM OSS: PyPI litellm==1.107.0 (all seven wheels); Docker Hub/GHCR images v1.107.0, latest, main-latest, main-stable (litellm, litellm-database, litellm-non_root)
Mitigation
Do NOT pip install to clean an environment (it re-triggers the .pth hooks). Delete cook.pth, cook.py, sitecustomize.py and __pycache__ counterparts; kill the detached Python daemon holding /tmp/remote_code_loader.lock; rebuild images/venvs and pin litellm==1.106.2 or earlier. Incident page: https://docs.litellm.ai/blog/security-incident-oct-21-2026. Treat any affected environment as fully compromised (assume exfil if it had outbound internet).