Compromised LiteLLM 1.107.0 wheels on PyPI and four Docker tags (2026-10-21, two hours): pin a clean version, remove dropped files, rotate every key

View raw markdownEdit on GitHub ↗

TL;DR

If litellm==1.107.0 was installed, or one of the four image tags was pulled, in the window on 2026-10-21, the host ran a credential stealer in every Python process and the proxy's provider-key table was taken. Pin a clean version, remove the dropped files, and rotate from a clean machine. The root cause and timeline are in the companion advisory.

Packages and versions

Ecosystem Name Bad versions Clean version or action Registry state (date checked) Record
PyPI litellm 1.107.0 (uploaded 11:39 UTC 2026-10-21, removed 13:23 UTC) pin 1.106.2 or 1.107.0rc2; later releases are vendor-stated clean 1.107.0 removed; pip index versions litellm returned nothing in this session (2026-10-26) vendor incident post; Wiz; SafeDep
Docker (GHCR) ghcr.io/berriai/litellm v1.107.0, latest, main-latest, main-stable as pushed 11:46 UTC, replaced 14:20 UTC re-pull by digest from a current tag tags replaced (vendor, 2026-10-21) vendor incident post
Docker Hub litellm/litellm same four tags, same window re-pull by digest tags replaced (vendor, 2026-10-21) vendor incident post

Markers on an affected host (Wiz, SafeDep): cook.pth, cook.py and sitecustomize.py in the environment's site-packages, and an hourly detached process that was not there before. The wheel and image hashes are on the SafeDep and Wiz posts.

Am I affected?

  • pip show litellm | grep -i version, lockfiles and requirements.txt for 1.107.0; docker images --digests | grep litellm for an image created on 2026-10-21 before 14:20 UTC.
  • ls "$(python -c 'import site;print(site.getsitepackages()[0])')" | grep -E 'cook\.(pth|py)|sitecustomize' in each virtualenv and container that had the package.
  • Cloud audit logs for the instance role of any host that ran the proxy, from 11:39 UTC 10-21 onward.

If you are affected

  1. Stop the proxy, snapshot for evidence, then rebuild the environment from a clean base rather than deleting the three files in place.
  2. Rotate from a clean machine: every model-provider key in the proxy's table and in its .env, the proxy master key, database credentials, cloud and instance-role credentials, SSH, GitHub, npm and PyPI tokens, browser-saved logins. Rotating cloud credentials, if your GitHub PAT leaked.
  3. Review provider dashboards for spend and new keys created after the window.

Prevention

  • Package vetting checklist: pin by hash, delay upgrades of gateway software by a day, mirror images by digest.
  • Credential hygiene: the proxy's key table is the highest-value file on the host; keep it in a secrets manager with short-lived access.

Sources