LiteLLM Supply-Chain Attack Pushes Malware via PyPI and Docker

According to BleepingComputer, the release pipeline of open-source LiteLLM — an AI model gateway and Python SDK with tens of millions of monthly PyPI downloads — was compromised on 21 October 2026. Attackers published malicious version 1.107.0 on PyPI and Docker images (including latest) that steal credentials, secrets and environment variables and load remote-code-execution tooling.

The maintainer’s post-mortem says PyPI wheels were live for roughly two hours (about 11:39–13:23 UTC) and Docker Hub tags for about two and a half. Malware hooks such as cook.pth, cook.py and sitecustomize.py ran on every Python startup, targeting AWS, Kubernetes, GitHub keys, browser data and more. The recommended recovery version is 1.106.2; infected hosts should be isolated, rebuilt from clean backups and have all exposed secrets rotated. Private enterprise LiteLLM customers were not impacted.

Sources: BleepingComputer, LiteLLM incident post.