MediumII Cyber Warfare & Critical Infrastructure21 October 2026, Wednesday
Hijacked LiteLLM release pipeline ships credential-stealing malware
LiteLLM's release pipeline was compromised on 21 October, and the malicious version 1.107.0 stayed live for 1 hour 44 minutes on PyPI and about 2.5 hours on Docker. It carried code that steals cloud, developer and AI provider credentials; it is the project's 2nd supply chain attack this year.
According to BleepingComputer, the attacker did not alter the application code. Instead, 3 files were added to the Python library directory that run every time Python starts in the environment. The malicious package appeared in 7 PyPI distributions and in 4 tags on Docker Hub and GHCR. Security firms detected the attack within 6 minutes of release. LiteLLM is a gateway that lets users reach multiple AI providers through a single interface; it has about 61,800 stars on GitHub and 92 million PyPI downloads a month.
Help Net Security reported on 22 October that the attacker used stolen GitHub CLI OAuth tokens belonging to 3 LiteLLM engineers. One altered the pipeline and triggered the release, a second approved it and a third deleted the workflow logs. The tokens had been lifted from the logs of an internet-exposed internal deployment. About 4.5 hours after the data was exfiltrated, the attacker used stolen AWS keys to probe access to models on Amazon Bedrock. This is LLMjacking: running models on someone else's account. As of 22 October the perpetrator had not been named.
In the first breach, in March 2026, a 153 GB archive was stolen, which Hudson Rock linked to 2,488 corporate domains including AWS, Samsung, Cisco and Salesforce. According to BleepingComputer, the TeamPCP group carried out that attack by compromising the Trivy scanner used in LiteLLM's release pipeline. The project names 1.106.2 as the safe version, but stresses that upgrading alone is not enough: every key in any environment where 1.107.0 was installed must be rotated.
Talay assessment
Bottom line
LiteLLM is the layer where companies pool the keys to multiple AI providers in one place, so the breach is less a library incident than a collective risk to corporate AI credentials. Detection within 6 minutes limited the damage, but leaked tokens can be abused for weeks. A second hit on the same project this year shows release-pipeline security is the weakest link in the AI toolchain.
Likely effects
- Corporate AI costsNegativeWeeks
Running models with stolen cloud keys leaves victims exposed to unexpected bills and unauthorised data access.
- Open-source supply chainUncertain1–6 months
Requirements for signed releases and token management on PyPI and Docker tighten; companies move towards pinned versions of AI libraries.
Possibilities, ranked
- 1Token abuse continues55%
Leaked cloud and provider keys are used for weeks to run models and access data.
Watch: Cloud providers or security firms reporting LLMjacking cases linked to LiteLLM
- 2Impact stays small30%
The brief release window and rapid detection keep the number of affected installations limited.
Watch: The number of affected installations in LiteLLM's final incident report
- 3Perpetrator and links emerge15%
The attack is attributed to the TeamPCP group behind the March breach, or to another actor.
Watch: A security firm tying the 1.107.0 attack to a named group
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Monthly PyPI downloads▼ 92 million
- Live on Docker▼ ~2.5 hours
- Time to detection▲ 6 minutes