LiteLLM, an open-source tool developers use to route requests to AI models, shipped a booby-trapped release on Wednesday, Oct. 21, 2026. The company said its release pipeline was compromised and pushed version 1.107.0 to PyPI and Docker with "compiled malware which steals credentials and loads remote-code execution tools." The PyPI package was live for about two hours (11:39 to 13:23 UTC, or 4:39 to 6:23 a.m. PT), and the Docker tags v1.107.0, latest, main-latest and main-stable were affected until 14:20 UTC.
What the malware did
JFrog Security Research said all seven 1.107.0 wheels carried three extra files that run whenever Python starts, even if an app never imports LiteLLM. The stealer, which calls itself "privcollect," goes after SSH and GPG keys, browser passwords, AWS/Azure/Google Cloud and Kubernetes credentials, and settings for AI coding tools including Cursor, Claude, Codex, Gemini and GitHub Copilot. On LiteLLM proxy servers it also tries to dump every stored AI-provider key. A second file sets up an hourly loader that can run remote code.
How it happened
LiteLLM said the attacker held three developers' GitHub CLI tokens, used an organization owner's token to override branch protection, and pointed the release workflow at a lookalike repository, "Berri-AI/litellm." It said it believes the tokens came from logs of an internal LiteLLM deployment that was exposed to the internet. JFrog said this is the second LiteLLM hijacking of 2026, after a March incident, and so far found nothing linking the two campaigns. Enterprise customers on LiteLLM's private registry were not affected.
What to do
LiteLLM says anyone who installed 1.107.0 or ran the affected images should treat that machine as compromised: delete cook.pth, cook.py and sitecustomize.py before running pip, kill the background process, rebuild pinned to litellm==1.106.2, and rotate every reachable credential.
It's the second major AI-related security story today; see how AI found the PHP2Shell flaws.
