> ## Content Index
> Fetch the complete content index at: https://espresso.cafecito.tech/llms.txt
> Use this file to discover other available public pages before exploring further.

# Malicious LiteLLM 1.107.0 build pulled from PyPI and Docker Hub
- URL: https://espresso.cafecito.tech/malicious-litellm-1-107-0-build-pypi-docker-hub/
- Published: 2026-10-26T11:31:58.000Z
- Updated: 2026-10-26T11:31:58.000Z
- Description: Attackers pushed a malicious LiteLLM 1.107.0 build to PyPI and container registries on Oct. 21, 2026, pulled the same day. Startup files ran with installer permissions, so credentials on affected machines stay valid until rotated.
- Author: Barista @ Cafecito
- Tags: Artificial Intelligence, Technology, AI Models, AI Infrastructure, AI Policy

Attackers published a poisoned version of the open-source AI gateway LiteLLM and used it to harvest cloud and developer credentials from machines that installed it. The malicious build surfaced on PyPI and container registries on Oct. 21, 2026, and was pulled the same day.

### What the package did

LiteLLM acts as a gateway, letting an application call OpenAI, Anthropic, Google Gemini, AWS Bedrock and other providers through one interface. Version 1.107.0, reported by Socket Security, Step Security and SafeDep, added a `sitecustomize.py` file that Python imports automatically at interpreter startup. A second file, `litellm_init.pth`, did the same job in environments that load `.pth` startup files. Both run before user code, so the payload didn't depend on anyone importing LiteLLM directly.

Once active, the code swept the machine for cloud credentials, private keys, browser data and authentication files for Claude, Codex, Copilot, Cursor and Gemini, then tried to push them to an external endpoint. Socket reported that it also targeted Kubernetes, Vault and Terraform secrets, widening the reach from a single stolen key to whole build and deployment systems.

### How it got out and where it went

The attackers obtained a GitHub CLI OAuth token and released the build through a lookalike repository, Berri-AI/litellm, according to reporting summarized Oct. 23\. The same build was distributed as all seven PyPI wheels, four Docker tags including "latest," and four GitHub Container Registry tags, with the Docker image published as `berri_ai/litellm`. That spread the exposure to containerized setups where developers mount directories like \~/.aws. Reported compromise details also describe a remote-access tool, credential theft, and keys tied to AWS, GitHub, Azure, Samsung, Salesforce and Cisco. None of those companies has confirmed unauthorized access through LiteLLM.

The release window ran 11:39 to 13:23 UTC on Wednesday, Oct. 21, 2026 — roughly three hours on PyPI and about two on Docker Hub. There's still no public count of who pulled it.

### Rollback and what's still open

LiteLLM removed the malicious package, repointed the affected Docker tags, and restricted maintainer credentials, according to Oct. 23 reporting. SafeDep, Step Security and Socket published technical breakdowns. The same reporting described containment as complete with remediation under way.

The unresolved point: the poisoned files run with the installer's own permissions, so any credential on a machine that pulled the build stays valid until it's rotated. Whether the 1.107.0 payload ever executed in a real pipeline is still unconfirmed. That execution question — not the takedown — is what decides whether anyone's keys are already sitting in someone else's hands.

[![Beans](https://beans.cafecito.tech/favicon.ico)Explore more coverage on BeansSearch this story across publishers→](https://beans.cafecito.tech/search?q=Malicious%20LiteLLM%201.107.0%20build%20pulled%20from%20PyPI%20and%20Docker%20Hub&utm%5Fsource=espresso.cafecito.tech&utm%5Fmedium=referral&utm%5Fcampaign=cafecito&utm%5Fcontent=malicious-litellm-1-107-0-build-pypi-docker-hub)