- LiteLLM explained how a key pushed to a public repository in May and never revoked gave an attacker a way in.
- On 21 October a poisoned version 1.107.0 hit PyPI; in about 2 hours it was downloaded roughly 49,000 times (Wiz data).
- Wiz names 1.106.2 as the latest safe version.
In short: LiteLLM, a popular open source gateway that connects apps to many AI models, published an analysis of the attack on 23 October 2026. It all started with a key that landed in a public repository back in May. The commit was overwritten, but the key was never revoked. It is a textbook supply chain attack.
How the attack unfolded (according to LiteLLM)
- 27 May 2026: a config file holding the master key to an internal agent platform was committed to a public repository. No key revocation followed.
- 10 October: the attacker used the key, read a GitHub token belonging to an organisation owner from the platform, and used planted CI jobs to pull out more secrets, including tokens of two maintainers.
- 21 October, around 11:40 UTC:
litellm==1.107.0was published to PyPI (seven files), with Docker images shortly after. - About 20 minutes later a user reported the problem, and PyPI quarantined the version at 13:23 UTC. The poisoned files were live for about two hours.
- The company says the release approval rule had been relaxed that same week; it used to require an account tied to a physical device in the office.
What the malware stole
According to Wiz, the version was downloaded around 49,000 times. The infostealer ran every time Python started and collected browser passwords and cookies, AWS, Google Cloud and Azure credentials, keys for OpenAI, Anthropic and other model providers, and SSH keys, among other things.
What to check
- Whether
litellm==1.107.0, or alatestimage pulled on 21 October, was installed anywhere. Wiz names 1.106.2 as the latest safe version. - If so: treat every key reachable from that machine as stolen and rotate it.
- While you are at it: revoke any key that ever reached public code, even if the commit is gone.
How to read this
The analysis comes from the affected company itself, and the download count comes from Wiz; downloads include automated systems, so not every one is an infected server. I write about protecting AI projects in the AI code security hub.