LiteLLM Gateway Compromised in v1.107.0 Supply-Chain Attack: Emergency Rollback to 1.106.2 and Credential Rotation Issued

Background and the Problem

In modern AI agent architectures, unified proxy gateways occupy a critical infrastructure nexus. LiteLLM provides a standardized, OpenAI-compatible proxy interface capable of routing requests across hundreds of heterogeneous foundation models (Anthropic, Bedrock, Azure, Google). With millions of monthly downloads, LiteLLM is the default orchestration layer for leading agent platforms including LangChain, LlamaIndex, and OpenHands. However, because it manages confidential API keys and traffic at the application boundary, any supply-chain compromise enables attackers to weaponize upstream open-source dependencies and infiltrate enterprise networks. On October 22, 2026, cybersecurity intelligence teams, including SlowMist (@SlowMist_Team) and The Hacker News, issued emergency alerts regarding a critical supply-chain breach affecting LiteLLM's official distribution channels.

Architecture and How It Works

1. CI/CD Pipeline Token Compromise:

• Attackers leveraged stolen or forged publishing tokens to bypass standard pull request reviews and branch protections;
• Directly triggered packaging pipelines to distribute a trojanized v1.107.0 release across PyPI and official Docker Hub tags (latest and main-stable);

1. Stealth Credential-Exfiltration Payload:

• The malicious payload was embedded directly into the library's initialization lifecycle;
• Upon import litellm or container boot, the routine enumerated host environment variables, targeting keys matching OPENAI_API_KEY, ANTHROPIC_API_KEY, and cloud provider tokens, before tunneling them to attacker-controlled C2 servers;

1. Impacted Deployment Surface:

• Environments using unpinned dependencies (pip install litellm) or dynamic container manifests (litellm:latest) during the disclosure window ingested the malware automatically.

Benchmarks and Measured Results

• Incident Response & Remediation:
• Maintainers and external security researchers contained the incident within hours of telemetry alerts;
• Revoked compromised CI/CD credentials, pulled v1.107.0 from PyPI, and restored 1.106.2 as the latest safe release;
• Blast Radius Analysis:
• Any server, Kubernetes pod, or agent cluster that updated or rebuilt LiteLLM within the compromise window must be treated as fully compromised;
• Industry Impact:
• The breach highlights the severe systemic exposure of autonomous agent architectures to third-party open-source dependencies.

Getting Started for Developers

• Immediate Dependency Pinning:

  pip show litellm
  # If version is 1.107.0, force downgrade immediately:
  pip install "litellm==1.106.2" --force-reinstall
  

• Container Configuration: Discontinue the use of floating tags (:latest, :main-stable). Pin explicitly to immutable version digests (e.g. ghcr.io/berriai/litellm:v1.106.2);
• Mandatory Credential Rotation:
• Immediately revoke all model provider keys (OpenAI, Anthropic, Gemini, AWS/GCP) configured on affected hosts;
• Long-term Defense: Mandate cryptographically hashed dependency lockfiles (poetry.lock or hash-pinned requirements.txt) in production CI pipelines to prevent unverified upstream releases from auto-deploying.