Updates·October 23, 2026, 20:12

Popular AI tool LiteLLM was infected with credential-stealing code in version 1.107.0

AI-generated from the sources listed, with automated source checks.

Version 1.107.0 of LiteLLM was compromised with malicious code on October 21, 2026, that steals credentials and gives the attacker remote access. It was distributed both as a package and in official Docker images.

LiteLLM is a tool developers use to connect to many different AI services. Version 1.107.0 was compromised on October 21, 2026, and distributed both as a PyPI package (Python's main package repository) and in official Docker images (prepackaged applications). That is according to the security firm Socket and the blog LLM Gateway. According to LLM Gateway, it was Aikido Security that reported the compromise.

What was affected

According to Socket, the package files were published at 11:39:51 UTC, and Socket's AI scanner flagged the malware roughly seven minutes later. It involves seven distributions for macOS, Linux and Windows, as well as several container images on GHCR and Docker Hub. According to LLM Gateway, Docker tags such as latest, main-latest and main-stable also distributed the malware.

The package contained three Python startup files: cook.pth, cook.py and sitecustomize.py. They run whenever Python starts, without LiteLLM needing to be used or imported.

What it steals

According to Socket, the stealer looks for credentials for AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub CLI, Vault, Terraform and Packer. It also goes after developer credentials, login details for AI tools, browser data, and SSH and GPG keys. LLM Gateway adds that keys for all LLM providers in a LiteLLM proxy and secrets in CI/CD (automated development pipelines) are also targets.

The stolen data is encrypted with RSA-4096 and sent as JSON to www.litellm.dev/healthcheck, a domain that does not belong to the real project.

Remote control

According to Socket, the file sitecustomize.py works as a remote access trojan. According to both sources, it fetches commands from a GitHub repository every hour and runs the downloaded Python code without checking signatures. Socket notes that the GitHub pointer returned empty at 13:01:44 UTC, so the firm could not observe the active download phase. Socket also found a lookalike repository, Berri-AI/litellm, which is not the legitimate BerriAI/litellm.

How to check and protect yourself

According to LLM Gateway, signs of infection are the files /tmp/.pc_once_72129118c59f5636c0bb3 (the stealer) and /tmp/remote_code_loader.lock (the remote access trojan).

LLM Gateway recommends rotating all credentials from clean machines, rebuilding from uncompromised images and pinning dependencies by hash rather than version tags.

Caveats

Socket has not determined how accounts were compromised or how tokens were misused. Socket also points out that provenance documents show recorded inputs, not verified trustworthiness, and that some Linux-specific functions may not run on all platforms. The attack should not be confused with an earlier, separate attack on LiteLLM 1.82.7 and 1.82.8 in March 2026.