What We Know
On October 21, 2026, attackers published a malicious LiteLLM 1.107.0 release to PyPI and Docker.2Backed by 2 sourceslabs.cloudsecurityalliance.orgutilitykit.tools Reporting describes the compromise as using Python startup hooks to enable credential theft, including the collection of passwords and other secrets.1Backed by 1 sourcesmicrosoft.com
The Cloud Security Alliance characterizes the incident as a release takeover involving an unrevoked agent key, while LiteLLM’s reported account traces the poisoned release to a master key leaked in May.2Backed by 2 sourceslabs.cloudsecurityalliance.orgsoctember.com The reported chain also says the leaked key gave an intruder a GitHub owner’s token 11 days before the attack.1Backed by 1 sourcessoctember.com Security reporting has identified indicators of compromise and published guidance focused on checking exposure and rotating affected credentials.1Backed by 1 sourcesutilitykit.tools
Reporting highlights password and secret collection as the practical impact of the compromise, while separate material catalogs indicators of compromise for exposure assessment.2Context supported by 2 independent sourcesThe Registersocradar.io
Source Comparison
Aligned reportingCorroborates
- microsoft.com↗The report directly supports the account that Python startup hooks enabled credential theft involving passwords and other secrets.
- labs.cloudsecurityalliance.org↗The Cloud Security Alliance report supports the attack date, affected distribution channels, and its characterization of the incident as a release takeover involving an unrevoked key.
- utilitykit.tools↗The report supports the malicious release date and distribution channels, while its title and summary provide practical guidance on checking exposure and rotating credentials.
- soctember.com↗The report supports the account that a May-leaked, unrevoked master key was linked to an intruder obtaining a GitHub owner's token 11 days before the attack.
Adds context
- The Register↗The headline emphasizes the credential impact, specifically that the supply-chain attack collected passwords and secrets, but it does not supply the startup-hook detail.
- socradar.io↗The report contributes indicators-of-compromise material associated with the LiteLLM attack, adding operational detail to the exposure assessment.