An OAuth token ended up in a log file, and a few steps later a poisoned package was sitting on PyPI. That's the whole story, and it should bother you more than the malware does.

What happened

On October 21, 2026, LiteLLM 1.107.0 showed up on PyPI and in Docker registries carrying a credential stealer and a RAT that polls hourly. LiteLLM's current theory is that the attacker got GitHub CLI OAuth tokens out of AI gateway logs. Claude Code had put a user's token into a response body, the gateway logged that body, and somebody found it. From there the attacker disabled branch protections and published the bad artifacts. Stolen cloud credentials were then used for LLMjacking against AWS Bedrock.

Note the word "suspects." This is LiteLLM's working theory, not a finished postmortem, so hold the details loosely.

Old dog, new tricks

Secrets in logs is one of the oldest bugs in the book.…