Malicious LiteLLM release ships credential stealer and backdoor

A malicious version of the LiteLLM Python package was uploaded to PyPI and Docker on 21 October 2026, carrying code that steals credentials and a dormant backdoor, according to a report published the same day by cloud security firm Wiz.

The affected release is LiteLLM 1.107.0. Wiz said the malicious version includes a credential stealer that targets browser, cloud and AI secrets, as well as a dormant command-and-control capability. A dormant command-and-control capability is code that waits for instructions from an attacker-run server rather than acting immediately.

The Hacker News reported that the compromise was part of a software supply chain attack delivering both a credential stealer and a backdoor, citing reports from SafeDep, Socket, StepSecurity and Upwind. According to that report, the compromise affects LiteLLM 1.107.0 distributed through both PyPI wheels and Docker images. The Python package has since been quarantined on the Python Package Index, The Hacker News said.

A quarantine on PyPI stops a package version from being installed by normal means, but it does not reach copies that have already been downloaded, cached in build systems, or baked into container images. Because the sources say the bad code also shipped as a Docker image, teams that pulled the image on 21 October 2026 would not be protected by the PyPI action alone.

The sources do not state how many downloads the malicious version received, how the maintainer account or build pipeline was compromised, or who was responsible. Neither source names an attacker or a motive, and neither gives a figure for the number of organisations affected.

The incident matters for teams building AI agents because LiteLLM is widely used in Python projects that call language models, and the stealer described by Wiz specifically goes after AI secrets alongside browser and cloud credentials. Those are the same keys that agent deployments typically hold: model provider tokens, cloud access credentials and whatever else sits in the environment where the package runs.

Organisations that installed LiteLLM on or after 21 October 2026, or that pulled a LiteLLM Docker image that day, should check whether version 1.107.0 is present in their environments. Where it is, any credentials that were accessible to that process should be treated as exposed, on the basis of the capabilities described by Wiz.

LiteLLM had not published a statement in the sources reviewed for this article. Wiz, SafeDep, Socket, StepSecurity and Upwind have all reported on the compromise.