On 21 October 2026, a malicious LiteLLM 1.107.0 was published to PyPI and Docker registries for a few hours. It was built from a lookalike repository with compromised developer credentials and contained credential-stealing code. The official GitHub source tag was clean, and LiteLLM says private enterprise registry customers were not affected.

If you run LiteLLM as a gateway in front of model providers, here is a practical way to triage.

1. Check the exposure windows (UTC, 21 October)

PyPI litellm==1.107.0 : 11:39 to 13:23

Docker Hub tags v1.107.0 , latest , main-latest , main-stable : 11:46 to 14:20

GitHub Container Registry images ( litellm , litellm-database , litellm-non_root ): from 11:46 until unavailable by 13:51

Any unpinned install, image pull or CI build in those windows is a candidate.

2.…