23 Million Weekly Downloads. One Compromised Release: The LiteLLM Supply-Chain Incident and AI Security Guide

23 Million Weekly Downloads. One Compromised Release. A Serious Wake-Up Call for AI Security.

The LiteLLM supply-chain attack is an urgent reminder that even trusted, widely adopted open-source libraries can become an enterprise security risk overnight.

On October 21, 2026, attackers compromised the release pipeline of LiteLLM, an indispensable open-source library used by engineering teams globally to proxy and unify access to multiple LLM providers (including OpenAI, Anthropic, Google Gemini, AWS Bedrock, and Azure).

The result was an unauthorized, weaponized release of litellm==1.107.0 published directly to PyPI, alongside compromised official Docker container images on Docker Hub and GitHub Container Registry (GHCR).

Because LiteLLM receives approximately 23 million downloads per week, the incident represents one of the most consequential AI software supply chain compromises recorded to date.

---

1. What Happened? The Anatomy of the Attack

According to forensic disclosures from the LiteLLM maintainers and independent security researchers, the threat actors did not simply find a zero-day vulnerability in LiteLLM's application code. Instead, they compromised the project's build and distribution pipeline itself:

The Attack Chain: From Stolen Tokens to PyPI Distribution

Four Critical Dimensions of the Compromise

1. Trusted Software Became the Attack Vector:

Attackers used stolen GitHub CLI OAuth tokens associated with three developer accounts to launch LiteLLM’s private release workflow, approve the build, and delete the workflow run logs afterwards to conceal their activity.

1. The Malicious Package Stole High-Value Secrets:

The payload specifically targeted:

• AI Provider API Keys: OpenAI, Anthropic Claude, Google Gemini, Cohere, Cursor, Copilot, and LLM coding assistant session tokens.
• Cloud Infrastructure Access: AWS, GCP, and Azure credentials (including querying cloud instance metadata services / IMDS), Kubernetes service accounts, Docker secrets, HashiCorp Vault tokens, and Terraform credentials.
• Developer Tools & Databases: SSH keys, GPG keys, TLS certificates, .env files, Git credentials, npm/PyPI auth tokens, and database passwords stored in LiteLLM Proxy configurations.

1. Malware Persists Beyond the Package:

The release dropped cook.pth and sitecustomize.py into Python's site-packages directory. In Python, .pth files and sitecustomize.py are executed automatically every time the interpreter starts. This means any Python process running in that environment triggers the malware, even if litellm is never imported in code. Simply running pip uninstall litellm does not remove these dropped files.

1. AI Infrastructure as a Primary Exploitation Target (LLMjacking):

Exposed AI provider credentials enable attackers to conduct "LLM-jacking"—consuming thousands of dollars in high-tier model APIs for automated fuzzing, translation, or fine-tuning at the victim's expense. Researchers observed threat actors actively attempting to validate stolen AWS credentials and check quota access to frontier AI models immediately following exfiltration.

The compromised PyPI release was available for approximately two hours (11:39 to 13:20 UTC) before being quarantined. Affected Docker tags (v1.107.0, latest, main-latest, main-stable) remained accessible until 13:53 UTC.

---

2. Why This Matters: The New Frontier of AI Attack Surfaces

LiteLLM is not an isolated tool; it sits at the foundational layer of modern AI engineering stacks. It is embedded across:

• Developer Workstations: Data scientists and backend engineers prototyping generative applications.
• Automated CI/CD Pipelines: Automated unit and regression test suites running on GitHub Actions, GitLab, and Jenkins.
• Production AI Microservices: Enterprise API gateways routing millions of daily user prompts across LLM backends.

When a foundational proxy library is poisoned, a single automated dependency build (pip install --upgrade litellm or pulling litellm:latest) turns your CI/CD runner or production cluster into an exfiltration node.

Alarmingly, this is not LiteLLM's first supply-chain security incident in 2026. An earlier incident affecting versions 1.82.7 and 1.82.8 was linked to threat group activity. The repeat targeting highlights that AI gateway tools have become premier targets for threat actors seeking high-privilege cloud and model tokens.

---

3. What Security & Engineering Teams Must Do Now

Follow this 5-step incident triage playbook:

Step 1: Determine If You Were Exposed

Inspect your package registries, CI/CD run logs, and Docker container pull logs for installations between 11:39 UTC and 13:53 UTC on October 21, 2026:

```bash

# Check installed version in your Python environment:

pip show litellm

# Check if malicious dropped persistence files exist in site-packages:

python -c "import site; print(site.getsitepackages())"

# Look inside the returned directories for:

# - cook.pth

# - cook.py

# - sitecustomize.py

```

If your CI/CD pipeline built images or automated tests using unpinned requirements (e.g., litellm>=1.0.0 or docker pull ghcr.io/berriai/litellm:latest) during this 2-hour window, assume compromise.

Step 2: Neutralize Persistence & Roll Back

If litellm==1.107.0 was present:

1. Manually delete the dropped payload files:

```bash

rm -f /cook.pth

rm -f /cook.py

rm -f /sitecustomize.py

```

1. Revert to the latest known safe release:

```bash

pip install litellm==1.106.2

```

1. Rebuild base Docker images: If running containerized workloads, purge local image caches and pull verified images built prior to version 1.107.0 or after clean rebuilds.

Step 3: Complete Secret Rotation (Zero Exceptions)

Because the credential stealer gathered all environment secrets and transmitted them over encrypted HTTPS channels, you must rotate:

• AI Model API Keys: Immediately revoke and regenerate API keys for OpenAI, Anthropic, Google Gemini, Mistral, and Cohere.
• Cloud Infrastructure Credentials: Rotate AWS IAM access keys, GCP service account credentials, and Azure service principals configured in the affected hosts or CI runners.
• Database Connection Strings: Reset passwords for databases configured in LiteLLM Proxy database parameters.
• Developer Tokens: Revoke GitHub personal access tokens, SSH deploy keys, npm tokens, and PyPI publish credentials.

Step 4: Audit Telemetry for LLMjacking & Cloud Activity

Review CloudTrail, Google Cloud Audit Logs, and AI provider usage dashboards for anomalous events:

• Check for calls to sts:GetCallerIdentity or iam:ListUsers from unexpected IP ranges.
• Monitor AI platform usage metrics for sudden surges in token consumption or unusual prompt queries initiated from external IPs.
• Block network egress to the malicious lookalike exfiltration domain:

```text

www.litellm[.]dev

letters9813/pythonclient-test (GitHub)

```

Step 5: Enforce Software Supply Chain Guardrails

To prevent future pipeline compromises from infiltrating your infrastructure:

• Strict Dependency Pinning: Never use floating tags like latest in production Dockerfiles or unpinned ranges in requirements.txt. Always specify hash-pinned dependencies (e.g., via pip-tools or poetry.lock).
• Cryptographic Provenance Verification: Validate package signatures using Sigstore and enforce SLSA build provenance before ingesting third-party wheels.
• Egress Filtering on CI/CD Runners: Configure CI/CD runners to block outbound network access to unapproved external domains, preventing unexpected data exfiltration even if a malicious package executes.

---

4. The Bigger Picture: Your Supply Chain Is Your AI Attack Surface

The LiteLLM incident demonstrates how the rapid adoption of AI tooling has introduced fresh systemic risks into enterprise development lifecycles. Organizations invest heavily in model safety and guardrails, yet frequently overlook the Python packages connecting their applications to those models.

In the AI era, security is not just about what models generate—it is about the integrity of the code that powers them.