For nearly two hours on October 21, every LiteLLM 1.107.0 wheel on the Python Package Index was malicious. All seven wheels and compromised official container images carried code built to hunt for cloud keys, browser sessions, developer tokens and credentials for AI services.
The unsettling part was how little a victim had to do. Python startup alone could trigger the payload; an application did not have to import or actively use LiteLLM. Microsoft observed the mechanism on Windows and macOS.
The attack began months earlier with a secret left alive. LiteLLM says an administrative key for an experimental internal agent platform appeared in a public repository in May. The file was deleted from the repository tip about three hours later, while the key remained retrievable in public Git history and stayed valid.
In October, an attacker used that key to ask the platform for a GitHub token belonging to an organization owner. That powerful identity opened the rest of the doors. The attacker ran short-lived workflows that copied more maintainers’ credentials, altered LiteLLM’s private release process and pointed it at a lookalike repository. A stolen owner token overrode branch protection; another stolen maintainer token approved the production gate.
The legitimate pipeline then did exactly what it had been designed to do: it signed and published the attacker’s build. The approval looked real. The signature was real. The source underneath them was wrong.
Anyone who installed LiteLLM 1.107.0, used an unpinned install during the exposure window or ran the affected container tags should treat the environment as compromised. Starting cleanup with pip can trigger the payload again because pip starts Python. LiteLLM and Microsoft advise isolating the machine, examining it from a known-clean environment, rebuilding from verified artifacts and rotating every credential the system could reach—including active browser sessions.
The central lesson is about authority. A secret removed from view remains dangerous until it is revoked. A release gate loses its independence when stolen identities can rewrite the pipeline and approve the result. Trust must attach to the exact source, build and artifact behind the badge on the package.
Sources and evidence for this report
· Financial Integrity Watch