Open-source AI model gateway LiteLLM hit by supply chain attack; official release pipeline compromised to steal keys

The open-source AI model gateway LiteLLM suffered another supply chain attack on October 21, 2026. According to iThome, hackers stole GitHub login credentials from three LiteLLM engineers and used an account with administrative privileges to disable code modification protections. They redirected the official release system's source code reading location to a typosquatting repository with a similar name, allowing malicious code to be built and published through the official pipeline to platforms like PyPI and Docker Hub.

Affected versions include 1.107.0 on PyPI and multiple download options in Docker Hub and GitHub Container Registry repositories. Developers who downloaded images marked as 'latest' at the time may have obtained the malware even if they did not specify version 1.107.0. Customers obtaining enterprise versions from private repositories were unaffected. Security firm SafeDep analyzed the compromised package and found it injects malicious files into the Python execution environment, triggering credential theft that collects cloud service login credentials, AI service keys, remote access private keys, and keys stored in the LiteLLM database, sending them to external servers.

During its investigation, the LiteLLM team discovered that Anthropic's coding assistant Claude Code can place GitHub login credentials in its response content under certain circumstances, and this data might be logged within LiteLLM's internal systems. It remains unclear whether the hackers directly obtained credentials this way or how they initially breached the internal systems; the investigation is ongoing. Notably, the public source code for version 1.107.0 on GitHub did not contain the malicious files, which existed only in the built release packages.