Wiz and Datadog analyzed a malicious October 21 LiteLLM release distributed through PyPI and Docker. Stolen maintainer GitHub CLI OAuth tokens enabled release-workflow activity against a lookalike fork. Valid provenance recorded the build origin without ensuring benign code. Python startup hooks enabled credential collection and remote-control capability. Wi…
Inspect the ClaimsCase · DiggingBeagle record
LiteLLM 1.107.0 turned trusted distribution into AI credential theft
Scope
LiteLLM 1.107.0 and identified compromised Docker tags; separate from earlier LiteLLM proxy vulnerabilities.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
CLM-LITELLM-11070-1 reports: Wiz places PyPI publication at 11:39 UTC and quarantine at 13:20 UTC; compromised Docker images remained available until 13:53 UTC. Download counts are not victim counts. Source SRC-2026-CP17-WIZ-LITELLM-11070 is located at 'Executive summary; Timeline'. The distinctive mechanism begins: The adversary altered the trusted software-delivery path rather than injecting a prompt into LiteLLM. Classification: setting=production, exploit_status=confirmed_in_the_wild, evidence_grade=B on the bounded original investigator/vendor or paper evidence, without independent dynamic replication. remediation_status=mitigation_available; scoped control or limit: Avoid compromised 1.107.0 artifacts; rotate secrets on hosts where an affected wheel or image actually executed, and verify provenance of release assets as well as ownership of release credentials. Valid CI attestation establishes build origin, not that the build inputs were benign. The null impact band avoids an ungrounded cross-Case severity rating; observed damage, targeted population and controlled test outcomes cannot be exchanged as the same quantity. Where a patch is described, its availability is separate from independently tested effectiveness.
Assessed Oct 23, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-LITELLM-11070-1 · CLM-LITELLM-11070-2 · CLM-LITELLM-11070-3 · Wiz: LiteLLM 1.107.0 credential theft · Datadog: Compromised LiteLLM PyPI and Docker releases
At a glance
Initial token-theft mechanism remains under investigation; a proposed Claude Code/logging route is not independently established. Total affected installations, successful credential use and cleanup completeness are unknown.
Limits and uncertaintyFull account
Wiz and Datadog analyzed a malicious October 21 LiteLLM release distributed through PyPI and Docker. Stolen maintainer GitHub CLI OAuth tokens enabled release-workflow activity against a lookalike fork. Valid provenance recorded the build origin without ensuring benign code. Python startup hooks enabled credential collection and remote-control capability. Wiz and Datadog.
Mechanism, preconditions and effects. The adversary altered the trusted software-delivery path rather than injecting a prompt into LiteLLM. Compromised GitHub credentials enabled malicious builds of release 1.107.0, and Python startup hooks such as cook.pth/sitecustomize.py executed credential-stealing code when downstream Python processes started. Datadog also described remote-access components. Wiz recorded later AWS identity checks and Bedrock model enumeration, which are observed reconnaissance rather than proven costly inference jobs.
Comparison and evidence limits. PyPI and Docker distribution have different exposure intervals, and a download count cannot determine execution, theft or the number of exposed API keys. Wiz reports a shorter endpoint for image availability than LiteLLM's vendor incident notice; the underlying observations should retain their authors and not be collapsed into a fabricated single cleanup time. An earlier LiteLLM compromise in 2026 has not been causally connected to this one.
Timeline
- Oct 21, 2026occurrence
Occurrence began
Claims & evidence
CLM-LITELLM-11070-1Wiz places PyPI publication at 11:39 UTC and quarantine at 13:20 UTC; compromised Docker images remained available until 13:53 UTC. Download counts are not victim counts.supported
Basis: reported finding
- supportsWiz: LiteLLM 1.107.0 credential theftprimary disclosure
Executive summary; Timeline
CLM-LITELLM-11070-2Datadog identified startup execution through cook.pth and sitecustomize.py and credential collection targeting AI-provider, developer and cloud secrets.supported
Basis: reported finding
- supportsDatadog: Compromised LiteLLM PyPI and Docker releasesprimary disclosure
Malicious package and credential-stealing payload analysis
CLM-LITELLM-11070-3Wiz observed AWS identity and Bedrock model-enumeration requests about 4.5 hours after exfiltration across multiple environments; that establishes reconnaissance, not paid model consumption.supported
Basis: reported finding
- supportsWiz: LiteLLM 1.107.0 credential theftprimary disclosure
Post-Exploitation Activity
Controls and mitigations
- Avoid compromised 1.107.0 artifacts; rotate secrets on hosts where an affected wheel or image actually executed, and verify provenance of release assets as well as ownership of release credentials. Valid CI attestation establishes build origin, not that the build inputs were benign.
Unknowns and contradictions
- Initial token-theft mechanism remains under investigation; a proposed Claude Code/logging route is not independently established.
- Total affected installations, successful credential use and cleanup completeness are unknown.
Sources and citation
Material revision history
- Oct 23, 2026 · Canonical change recorded · new in release · revision 183