LiteLLM version 1.107.0 has been confirmed to contain credential-stealing code, and any environment that installed it should be treated as compromised. On October 21, 2026, security firm Wiz disclosed that a trojanized LiteLLM 1.107.0 was uploaded to PyPI at 11:39 UTC that day. The same malicious build also reached several image tags on GHCR and Docker Hub, which were removed around 13:53 UTC. The most recent safe version is 1.106.2.
It steals a machine's whole vault, not a single key
Once installed, the malicious package drops three files into the root of Python's site-packages, and they run whenever a Python interpreter starts. Its stealer sweeps browser-saved accounts and cookies, AWS, GCP and Azure cloud credentials, and SSH private keys, and it specifically hunts API keys for OpenAI, Anthropic and other model providers stored in environment variables and config files. Worse, LiteLLM Proxy itself stores upstream provider keys in its own database, and the stealer queries that credentials table directly, pulling up to 500 entries at once. In practice, the victim is often a shared team model gateway, so one compromised machine can expose an entire company's model keys.
Stolen data is encrypted and sent to an attacker-controlled domain impersonating LiteLLM infrastructure, disguised as a health-check endpoint that is easy to overlook in logs.
Three things to do now
First, check versions immediately: any environment that installed 1.107.0 or pulled affected tags such as latest should be treated as breached, without waiting for a strange bill. Second, rotate broadly: cloud keys, model API keys, SSH keys, and important browser-saved accounts all need replacement; rotating only LiteLLM's own configuration is nowhere near enough. Third, hunt for host traces: look for unexpected startup files in the site-packages root, unfamiliar run markers in temporary directories, and review outbound requests from that window.
LiteLLM is a popular gateway for accessing many model providers through one interface, and the larger its user base, the higher the payoff of poisoning its supply chain. The lesson goes beyond one package: gateway tools hold high privileges and handle many keys, so upgrades should be verified in an isolated environment before they reach production.
