LiteLLM Shipped Malware on October 21 — 49K Downloads Before Anyone Noticed

A poisoned release of LiteLLM, version 1.107.0, was pushed to PyPI and Docker Hub on October 21, 2026 by someone with maintainer access, and was downloaded 49,000 times during the one hour and forty-four minutes it was live on PyPI. The package contained a credential stealer and an hourly remote code execution loader, compromising any Python environment with LiteLLM installed. LiteLLM, an open-source AI gateway used to route requests across providers including OpenAI, Anthropic and Gemini, sees 23 million downloads a week.

On October 21, 2026, someone with maintainer access to LiteLLM pushed a poisoned release — version 1.107.0 — to PyPI and Docker Hub. The package contained a professional-grade credential stealer and an hourly remote code execution loader. It was live on PyPI for one hour and forty-four minutes. In that window, 49,000 developers downloaded it. If you run any Python environment with LiteLLM installed, treat it as compromised until proven otherwise. LiteLLM is the open-source AI gateway most teams use to route requests across providers — OpenAI, Anthropic, Gemini, and dozens of others. It sees 23 million downloads a week … The post