What Happened
On October 21, LiteLLM v1.107.0 was pushed to PyPI and Docker registries carrying credential-stealing malware. LiteLLM is one of the most widely used open-source AI gateway SDKs — it's the layer many teams use to route calls across OpenAI, Anthropic, Google, and others from a single interface. Attackers compromised the release pipeline using stolen GitHub CLI OAuth tokens and had a roughly two-hour window (11:39–13:23 UTC) before the malicious version was pulled.
The malware ran Python startup hooks, which means it activated at process startup — not on import. If your environment installed LiteLLM during that window without a pinned version, you were exposed whether or not your application ever called a single LiteLLM function. Stolen credentials were observed being actively abused within 4.5 hours of exfiltration, including IAM enumeration and model-listing calls consistent with compute theft.
Targeted secrets included AWS, Azure, and GCP identities, plus AI provider keys for Claude, Codex, Gemini, and Cursor, plus CI/CD secrets.
Why AI Keys Are High-Value Targets Now
This isn't a one-off. It's the second supply-chain compromise of this project in 2026, and it reflects a structural shift: LLM compute is expensive, and stolen API keys let attackers run their own workloads on your budget — a pattern Wiz has labeled