LiteLLM 1.107.0 on PyPI and Docker was poisoned with a credential stealer and RAT after attackers took GitHub tokens from an exposed internal LiteLLM deployment's logs, where LiteLLM says Claude Code had embedded them

Why it matters

【Key points】

On Oct 21, LiteLLM, the open-source gateway that routes traffic to dozens of LLM providers (~23M weekly downloads per Datadog), confirmed attackers hijacked its release pipeline and shipped a poisoned v1.107.0. All seven PyPI wheels were live 11:39–13:23 UTC. Docker tags v1.107.0/latest/main-latest/main-stable pointed to a bad image 11:46–14:20 UTC. The GitHub source was clean and the enterprise registry was unaffected.

The payload runs on every Python start without importing litellm. It steals cloud, SSH, Kubernetes, CI, browser and AI-tool (~/.claude, ~/.cursor) secrets and fetches remote code hourly.

LiteLLM's preliminary account: the attacker got into an internet-exposed internal LiteLLM deployment and lifted three developers' GitHub CLI tokens from its logs. LiteLLM says Claude Code can sometimes embed those tokens in responses. An org-owner token disabled branch protection and pointed the release at a lookalike repo, Berri-AI/litellm. Fix: delete cook.pth/cook.py/sitecustomize.py before running pip, pin 1.106.2, rotate every reachable secret.

【Verifiable】

https://docs.litellm.ai/blog/security-incident-oct-21-2026

https://osv.dev/vulnerability/MAL-2026-2144

https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/

https://www.ox.security/blog/litellm-1-107-0-compromised-with-a-rat-infostealer/

【Our read】

1. It is LiteLLM's second poisoning this year. Post-March hardening (private release repo, trusted publishing, a single locked laptop) was bypassed with stolen tokens, not code flaws.

2. Unlike Storm-0940 (e/1031), where attackers used AI tools, here the AI toolchain's own logs leaked the keys. A gateway holds every provider key a company has.

3. Treat agent and gateway logs as secrets, and pin versions. Open questions: initial access, the Claude Code conditions (no Anthropic comment yet) and victim count.