A poisoned release of LiteLLM, the Python library many teams use to call multiple AI model providers, hit PyPI and Docker Hub on October 21, 2026. Version 1.107.0 shipped with a credential stealer and a backdoor. The fix is to pin version 1.106.2, rotate every credential the bad build could reach, and treat your AI gateway as the high-value target it has become.
What happened and when
According to security firm Chainguard, LiteLLM 1.107.0 appeared on PyPI at 11:39 UTC on October 21, 2026, and its malware scanning flagged the package 16 minutes later. Chainguard's analysis found that all seven prebuilt wheels carried a credential stealer and a remote code loader that checks for new instructions every hour. The loader was empty when Chainguard examined it. The GitHub source was clean, but the published packages were not. That gap is the detail to remember: reviewing a repository tells you little about what actually lands on your server.
The Hacker News reported the same compromise and described a file called cook.pth that runs at Python startup, before LiteLLM is even imported. In other words, installing the package and launching Python is enough. PyPI quarantined the package, and the malicious Docker images were removed.
How the attackers got in
LiteLLM's director of security, Oliver Jensen, told The Hacker News that the malicious actions ran through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. One account triggered the release process and another approved it. The company says every token involved has been revoked and that it removed all but one unaffected user from its GitHub organization. How the tokens were stolen is still unknown, and the investigation is ongoing.
Chainguard also notes this is the second compromise of LiteLLM in seven months. In March 2026, the TeamPCP group used a stolen PyPI token to publish versions 1.82.7 and 1.82.8. Chainguard says researchers have not linked the October incident to TeamPCP or to that March access path, so the root cause remains an open question. Two incidents in seven months is not bad luck. It is a pattern.
Why this matters for solo operators and marketers
Chainguard reports that LiteLLM sees more than 100 million PyPI downloads in a month and that more than 2,000 packages depend on it. That is the trap. Few people install LiteLLM on purpose anymore. It arrives as a dependency inside agent frameworks, internal scripts, and the automation tools you bought from a vendor who bought them from someone else. Per Chainguard, the stealer targets SSH keys, cloud and CI/CD credentials, browser data, and AI-tool credentials. It also dumps the LiteLLM tables that store credentials and proxy model configuration. Chainguard says no customer pulled 1.107.0, which is the kind of sentence that makes a security team exhale.
For a marketing operation, that list reads like a map of the business. The model-provider keys that pay for your content and lead-scoring jobs, the ad-platform and CRM tokens sitting in a script you wrote late one night, and the cloud account holding your reporting data are all fair game for a stealer like this. One stolen key can cost you a week of cleanup and a conversation nobody wants to have.
What to do this week
Start by finding out whether you are exposed. Search your Python environments, lockfiles, and container images for LiteLLM 1.107.0. Chainguard lists Docker images tagged v1.107.0, latest, main-latest, and main-stable among the affected artifacts, so if you pulled a latest tag on or after October 21, assume the image is compromised. If you find a hit, isolate that host first, delete cook.pth, cook.py, and sitecustomize.py, and do not run Python on it again until it is rebuilt. Block outbound traffic to the look-alike domain Chainguard flagged, litellm[.]dev.
Then pin. Both Chainguard and The Hacker News point to version 1.106.2, and for containers, pinning by digest rather than by tag is the safer habit. Rebuild from verified artifacts. Rotate every credential the affected environment could reach, starting with your model-provider keys, and do the rotation from a clean machine rather than the one you suspect.
Our take
Our opinion is that the AI stack has inherited every supply-chain problem the web has ever had, and most small shops cannot say what they are running. Your AI gateway is a credential vault with a friendly README. It concentrates model keys, cloud access, and automation logic in one place, which is exactly why attackers want it. Convenience and concentration are the same feature seen from two angles, and the bill arrives later.
Stop installing "latest." Pin every dependency, keep a written inventory of which tools hold which keys, and rotate those keys on a calendar instead of after an incident. Anyone who has spent a quarter century in digital marketing has seen this movie. A tag nobody owns eventually becomes the vulnerability nobody can find. The same logic now applies to the Python packages running your ad automations, and the teams that file this under IT will learn that marketing owns a lot of those keys.
One caveat: the investigation is still open and the initial access method is unconfirmed. Treat the details here as the state of reporting at publication, and check the linked sources for updates.
Sources
Chainguard: LiteLLM attacked again: Malicious 1.107.0 wheels on PyPI and Docker Hub