Attackers hijacked the software release pipeline of LiteLLM, a widely used open-source AI gateway, to distribute credential-stealing malware on October 21, marking the project's second supply chain compromise this year despite security measures introduced after an earlier attack. The compromised version, 1.107.0, was distributed through the Python Package Index and official Docker images, according to a report published by CSO Online. The malicious Python packages remained available for approximately two hours before removal, while affected Docker images were withdrawn or replaced later that day.
The compromised package contained malware designed to collect sensitive information from infected systems, including cloud credentials and API keys stored in LiteLLM's database, potentially granting attackers access to services beyond the affected AI gateway, according to cybersecurity firm Aikido. Files bundled with the compromised package executed automatically when Python started, even if an application didn't import LiteLLM. The malware also targeted Kubernetes service account tokens and secrets associated with CI/CD systems, including GitLab and Jenkins. A remote access trojan within the package launched a background process to retrieve and execute code from attacker-controlled infrastructure every hour, allowing continued command execution on infected systems after initial credential theft. The affected Docker images included those distributed under the latest, main-latest, and main-stable tags, extending the risk to deployments that pulled those tags during the exposure window.
LiteLLM said in its incident report that attackers used stolen GitHub credentials associated with three developer accounts to manipulate its software release pipeline, with the stolen credentials enabling changes to the release workflow that redirected it to an attacker-controlled lookalike repository. The company said the attackers may have obtained the credentials from logs associated with an internet-facing internal LiteLLM deployment, and it also identified circumstances in which Claude Code could expose GitHub authentication tokens in responses subsequently recorded by LiteLLM. LiteLLM advised organizations running the compromised open-source software to "treat their environments as potentially breached and rotate exposed credentials rather than relying solely on removing the malicious package." Keith Prabhu, CEO of Confidis, said "a compromised LiteLLM gateway provides a strong foothold to hackers and could expose far more than AI API keys."
The incident reveals how malicious code can pass through an authorized software signing process when attackers compromise the release pipeline, since a valid digital signature can verify that an artifact hasn't been altered since signing but can't establish whether the code was safe when it was signed. In March, malicious versions of LiteLLM's Python package were distributed following a compromise that the project linked to the Trivy security scanner used in its software release pipeline, after which LiteLLM strengthened its software release process by moving releases to a private repository and introducing signed Docker images. However, attackers used stolen GitHub credentials to modify the release workflow, which then signed and published the malicious software. The malware's remote access component could remain active even after the compromised package is removed, complicating efforts to determine whether an affected system is safe to restore. Sakshi Grover, research director for information and data security at IDC, warned that security teams should avoid launching Python or pip in suspected compromised environments because the malware's startup hooks could execute again.
The extent of any subsequent compromise may depend on the privileges assigned to the affected deployment and the credentials available to it, with IDC's Future Enterprise Resiliency and Spending Survey conducted in July 2026 finding that 95% of enterprises surveyed worldwide had at least one company-funded agent-enabled workflow in production. Prabhu recommended examining logs for evidence of persistent access or misuse of stolen credentials, and said organizations should rotate every secret accessible to the compromised deployment, including credentials associated with cloud infrastructure and development pipelines. Grover recommended restricting production deployments to verified package and image digests and requiring independent approval for changes to release workflows. Prabhu said repeated supply-chain compromises show that a trusted source repository doesn't guarantee that the package users install was built from that source, recommending cryptographically signed releases backed by verifiable build provenance alongside stronger protection of publishing credentials. Organizations that centralize AI access through gateways face a concentration risk that security controls must match, particularly as enterprises scale agent-based automation faster than they're hardening the infrastructure those agents depend on.