CERT24LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package ReleaseLoading data…
CERT24Threat Observatory
Period

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

LiteLLM’s release pipeline was compromised on October 21, 2026, and a malicious LiteLLM version 1.107.0 was published to PyPI, Docker Hub, and GHCR. The package contained code that stole credentials and keys and fetched additional code from a remote server every hour.

← Back to intelligence

LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release

LiteLLM’s release pipeline was compromised on October 21, 2026, and a malicious LiteLLM version 1.107.0 was published to PyPI, Docker Hub, and GHCR. The package contained code that stole credentials and keys and fetched additional code from a remote server every hour.