---
title: "[AUTO] LiteLLM compromised for second time this year"
pubDatetime: 2026-10-21T19:38:00.000Z
description: "LiteLLM 1.107.0 hit by supply-chain attack exfiltrating cloud and AI credentials. This is the second major compromise in 2026."
tags: [ai-security, supply-chain, vulnerability, litellm, 2026, 2026-q4, 2026-10, AUTO]
---
[LiteLLM 1.107.0 was compromised via GitHub account takeover](https://socket.dev/blog/litellm-compromise), injecting malicious Python files into PyPI and Docker that exfiltrate credentials from AWS, Azure, GCP, SSH/GPG, and AI providers (Claude, Gemini, Codex, Cursor), plus a RAT component for arbitrary code execution. Packages were quarantined quickly and OAuth tokens revoked.

The pattern matters more than the incident. This is LiteLLM's second major attack this year; March saw versions 1.82.7/1.82.8 compromised for roughly 40 minutes. The attacker specifically targets AI service tokens alongside cloud credentials, suggesting deliberate, organized interest in compromising AI development pipelines.

With 23 million weekly downloads, LiteLLM is a bottleneck in the AI infrastructure stack. The operational sophistication (encrypted exfiltration, scheduled execution, a RAT loader) indicates this was built to evade detection and persist, not a one-off opportunistic grab.

The real question: why the same project keeps getting hit, and what makes it such an attractive target.

---

*Sources: [LiteLLM 1.107.0 Supply Chain Attack: Technical Analysis](https://socket.dev/blog/litellm-compromise)  •  [LiteLLM Compromised Again: Infostealer and RAT in 1.107.0](https://llmgateway.io/blog/litellm-compromised-again)*

*Coverage: [LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor](https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html)*

*Related on this blog: [[AUTO] Malware campaigns weaponize AI platform trust](/posts/auto-ai-malware-delivery)  •  [[AUTO] PhantomRaven: Stealing Secrets for Bug Bounties](/posts/auto-phantomraven-bounty-stealer)  •  [[AUTO] NPM Supply Chain Trojan Commodifies Post-Exploitation With Embedded LLM C2](/posts/auto-redc2-npm-supply-chain)*