LiteLLM, a widely used open-source AI gateway and Python SDK, has published a root-cause analysis of last week’s supply-chain attack, and the cause was an old mistake. In May, the project accidentally published a configuration file containing the master key for an internal tool it uses to run AI agents. It removed the file but didn’t revoke the key. According to The Record, an attacker used that key earlier this month to get a token controlling all of LiteLLM’s GitHub repositories.

On October 21, the attacker published version 1.107.0 to PyPI. Within minutes, the official Docker Hub and GitHub Container Registry tags, including latest, pointed to compromised images. BleepingComputer reports the PyPI release was pulled within two hours and the container tags were fixed by mid-afternoon UTC. Wiz counted about 49,000 downloads of the malicious package.

The application code itself wasn’t changed. Instead, the installer dropped startup files (cook.pth, cook.py and sitecustomize.py) that run whenever Python starts, even if LiteLLM is never imported. The malware harvested cloud credentials (AWS, Azure, GCP, Kubernetes), AI provider keys, CI/CD and Git secrets, SSH keys, .env files and browser data. It also set up a loader that checks for new code every hour. About 4.5 hours after the upload, the attacker was already testing stolen AWS credentials against Amazon’s AI models, a pattern known as “LLMjacking.”

This is LiteLLM’s second supply-chain compromise this year. A March incident was linked to the TeamPCP group.

Why it matters / what to do

AI gateways hold some of a company’s most valuable secrets (keys to every model provider plus cloud credentials), and engineering teams often deploy them outside normal security review. LiteLLM’s own write-up shows that deleting a leaked secret without revoking it leaves the door open.

  • Find exposure: search package locks, container images and CI logs for litellm==1.107.0 and the affected image tags. Inspect machines without launching Python, since starting Python triggers the payload.
  • Rebuild, don’t clean: the project warns that deleting the package directory can leave the startup files or loader behind. Reinstall from a known-good build such as 1.106.2.
  • Rotate everything reachable: cloud keys, model-provider keys, Git and CI tokens, SSH keys.
  • Make it policy: any leaked secret gets revoked, not just deleted. Pin dependencies and image digests instead of pulling latest.

Sources: The Record (Oct. 26, 2026); BleepingComputer (Oct. 22, 2026)