LiteLLM shipped version 1.107.0 through PyPI and its official container images on October 21 carrying a credential stealer and a remote access trojan. The project calls it the second compromise of its release chain this year.
The window was short but awkward to reason about. Python users who pulled an unpinned package between 11:39 and 13:23 UTC were exposed. Docker and GHCR images tagged 1.107.0, latest, main-latest and main-stable were bad from 11:46 to 14:20 UTC. The safe build is v1.106.2.
It ran before you imported anything
Aikido researchers found the payload executed whenever Python started, whether or not an application touched LiteLLM. A bundled path file fired on interpreter launch. The malware then scooped cloud keys, API credentials and the secrets sitting in LiteLLM’s own database, and installed a daemon that fetched and ran code from outside infrastructure once an hour.
Ilyas Makari of Aikido gave defenders two file markers to check: /tmp/.pc_once_*, which means the exfiltration already happened, and /tmp/remote_code_loader.lock, which means the C2 process ran or is still running.
How the tokens got out
LiteLLM’s incident report says stolen GitHub credentials for three developer accounts rewrote the release workflow, pointing it at a lookalike repository. The company believes the tokens may have come from logs of an internal LiteLLM deployment reachable from the internet, and separately found cases where Claude Code echoed GitHub tokens into responses that ended up in those logs.
Its enterprise registry was untouched. Everyone else should assume compromise rather than deleting the package: rotate cloud, CI/CD and Kubernetes credentials, and audit for the two marker files.
