LiteLLM Supply Chain Attack: 7 Wheels, 2 Hours [2026] - shattered.io

The malicious package contained a credential stealer and remote-code loader that could execute even when the package wasn't imported, thanks to Python startup hooks. All seven platform wheels for the release were affected, including builds for macOS and Linux. The container side also took a hit, with compromised tags including v1.107.0, latest, main-latest and main-stable.

The PyPI exposure window ran from 11:39:51 to 13:23 UTC on October 21, while Docker Hub tags were affected from 11:46:56 until 14:20 UTC. Despite the seemingly short timeframe, automated builds and dependency bots could have spread the malware extensively within organizations.

Attack Mechanics

Microsoft's analysis revealed the compromised wheels delivered malicious Python startup files that load when the interpreter starts. This means any Python process launched in the infected environment after installation could trigger the stealer, including unrelated scripts and tools.

Attack Vector

LiteLLM reports attackers used stolen GitHub CLI credentials to alter release controls, redirecting the workflow to a look-alike repository named Berri-AI/litellm (instead of legitimate BerriAI/litellm). The project claims the attacker allegedly used one account to trigger the release workflow and another to approve it, bypassing review requirements.

The investigation into the initial vector was still ongoing as of October 25, with LiteLLM changing its signing setup and revoking compromised tokens. The project also notes that the official GitHub v1.107.0 source tag did not contain the malicious files, as the poisoned artifacts were built through a hijacked release workflow.

Broader Pattern

The attack follows a similar incident on OVHcloud CLI on October 19, where attackers hijacked a contributor's GitHub account and replaced release archives for versions v0.11.0 through v0.15.0. This replacement approach defeats version pinning defenses, as even pinned versions could receive malicious code if re-downloaded.

Both incidents reveal a concerning shift in attack patterns, with attackers targeting release pipelines and maintainer accounts rather than source code. As these attacks become more sophisticated, developers and organizations must harden their release processes and implement stronger verification mechanisms to protect against supply chain compromises.