What We Know
On October 21, 2026, LiteLLM reported that release v1.107.0 had been compromised, making the incident a supply-chain attack against software used in the path of model traffic and provider credentials.1Backed by 1 sourcesdocs.litellm.ai The compromised release reached PyPI, while malicious Docker or container images were also published with a payload designed to steal credentials, secrets, and environment data.1Backed by 1 sourcesBleepingComputer
LiteLLM reportedly traced the intrusion to a master key exposed in a public repository in May and not revoked, which allowed an attacker to obtain a GitHub owner token and publish the poisoned release.1Backed by 1 sourcesthreatfrontier.com
Microsoft’s reporting identifies Python startup hooks as the mechanism used for credential theft.1Context from one sourcemicrosoft.com Reporting describes the incident as harvesting passwords and secrets.1Context from one sourceThe Register The poisoned release involved a PyPI package and malicious Docker images carrying credential-stealing payloads.1Context from one sourceRescana
Source Comparison
Aligned reportingCorroborates
- docs.litellm.ai↗LiteLLM’s incident notice identifies the October 21 compromise of release v1.107.0, supporting the briefing’s central account of a supply-chain attack.
- BleepingComputer↗BleepingComputer reports that the compromised PyPI package and malicious Docker images carried a payload stealing credentials, secrets, and environment data.
- threatfrontier.com↗ThreatFrontier attributes publication of the poisoned release to a leaked master key exposed in May, linking it to a GitHub owner token and distribution through PyPI and GHCR.
Adds context
- microsoft.com↗Microsoft’s account identifies Python startup hooks as the credential-theft mechanism, supplying technical detail for the briefing’s description of the payload.
- The Register↗The headline characterizes the incident as harvesting passwords and secrets, reinforcing its credential-theft consequences without detailing the full distribution chain.
- Rescana↗Rescana frames the incident as a credential-stealing release affecting both PyPI and Docker, adding an operational warning to the distribution details.