On October 21, 2026, litellm==1.107.0 landed on PyPI with a credential stealer and a remote-code backdoor baked in. PyPI pulled it about two hours later.

This is the second time LiteLLM has done this. In March, versions 1.82.7 and 1.82.8 shipped malware too. Same package, same class of payload, seven months apart.

If you run LLM gateways, agents, or anything that pip install s into a box holding provider API keys, read on.

TL;DR

Bad version: litellm==1.107.0 (plus Docker images published the same day).

Clean versions: 1.106.2 , 1.107.0rc1 , 1.107.0rc2 , litellm-proxy-extras==0.4.110 , litellm-enterprise==0.1.78 .

The malware runs on every Python process start , not only when you import litellm.

It steals cloud creds, SSH keys, AI tool tokens, and the LiteLLM proxy DB's provider keys.

If it ran, rotate everything on that machine.…