The open-source software LiteLLM, designed for generative AI applications, was compromised when malicious code was injected into its official distribution packages. The attack allowed threat actors to steal authentication credentials and execute arbitrary code on affected systems.
Developers disclosed on October 21, 2026, that version LiteLLM 1.107.0 had been altered during the release process. This constituted a software supply chain attack in which attackers gained access to the build pipeline and distributed the tainted software through trusted repositories.
According to researchers at JFrog, seven malicious wheel files were published on the PyPI Python package index. Official container images hosted on Docker Hub and GitHub Container Registry were similarly affected.
The implanted malware implements credential-harvesting routines that target cloud service keys, SSH private keys, browser-stored credentials, and development environment tokens. It can also extract API keys for generative AI services directly from the LiteLLM database.
In addition, the code contains functionality to fetch and execute payloads from remote servers. It leverages Python's automatic execution hooks that run at interpreter startup, allowing the malicious logic to activate even if the LiteLLM application itself is never explicitly imported.
This is the second supply-chain compromise involving LiteLLM in 2026; developers stated that the March incident was unrelated to the current breach.
