LiteLLM PyPI supply-chain compromise: unrevoked leaked master key led to credential-harvesting malware in v1.107.0
Severity: critical · Patch status: no-fix-needed · Since 2026-10-26
LiteLLM, a widely used open-source AI gateway, disclosed a supply-chain attack after an attacker used a master key accidentally exposed in a configuration file in May 2026 and never revoked. Earlier in October the attacker used the key to access LiteLLM tooling and obtain a GitHub access token controlling all its repositories, then pushed a credential-harvesting version (1.107.0) to PyPI, where it stayed ~2 hours and was downloaded ~49,000 times. The malware ran on any Python startup and exfiltrated credentials; Wiz observed stolen AWS keys being tested within ~4.5 hours in an 'LLMjacking' pattern. LiteLLM advises anyone who installed 1.107.0 on an internet-connected machine to assume credentials were stolen and rotate all passwords and keys; it is revoking tokens across internal and vendor systems. Second LiteLLM supply-chain compromise this year, after a March TeamPCP-linked campaign.
What to do
- Check if LiteLLM 1.107.0 was installed on any internet-connected machine; assume credentials reachable from it were stolen
- Rotate all passwords, API keys, and cloud access keys (especially AWS) accessible from affected hosts; audit CloudTrail for unauthorized LLM model usage
- Hunt for the credential-harvesting malware triggering on Python startup on affected machines
- Pin and verify LiteLLM package versions/hashes before installing from PyPI
- Review CI/CD and GitHub token scopes for projects depending on LiteLLM
Sources
All live incidents on Threat Watch
