LiteLLM 1.107.0 Compromised in PyPI and Docker Supply Chain Attack to Steal AI Credentials

The LiteLLM Python package was compromised in a software supply chain attack targeting version 1.107.0 across PyPI wheels and Docker images, delivering a credential stealer and a persistent backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. Threat actors carried out the malicious release through three LiteLLM engineers' GitHub accounts, appearing to use stolen GitHub CLI OAuth tokens to trigger and approve the release workflow. The malware uses a "cook.pth" path file to execute automatically when the Python interpreter starts—even before LiteLLM is imported—mirroring a technique seen in the March 2026 TeamPCP supply chain attacks. Once active, the "privcollect" payload harvests cloud tokens, private keys, AI tooling authentication files, browser data from Chromium and Firefox, environment variables, and LiteLLM proxy credentials, while a background daemon checks a GitHub dead drop every hour to execute remote Python code. PyPI has quarantined the affected package and removed the malicious Docker images, while LiteLLM revoked the involved tokens, severed trusted registry links, and temporarily removed all but one unaffected user from its GitHub organization as it investigates how the tokens were acquired. "We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens." — Oliver Jensen, Director of Security at LiteLLM.