LiteLLM 1.107.0 shipped with a password stealer, and the attacker took GitHub CLI tokens

A compromised release of LiteLLM, the popular open source gateway that lets developers reach many AI models through one API, was published to the Python Package Index on October 21 as version 1.107.0. It was also distributed through official container images. The poisoned package sat on PyPI from 11:39 to 13:23 UTC, and the Docker images were live from 11:46 to 14:20 UTC.

Microsoft's analysis explains why it was so dangerous. The malicious wheel added files that Python executes during normal interpreter startup, so an application did not even need to import LiteLLM for the payload to run. Simply starting Python in an affected environment could be enough. In one Windows case, a routine pip install of an unrelated dependency triggered it. The collector went after credentials for developer tools, AI applications, cloud accounts, browsers and infrastructure, and a separate module tried to read credential and model configuration records from the LiteLLM proxy database.

LiteLLM's incident report, signed by its CEO, CTO and director of security, says the attacker got in through an internal deployment that was open to the public internet and "obtained the GitHub CLI OAuth tokens from its logs," then used them to compromise the release workflow. Its engineers found that Claude Code sometimes includes a user's GitHub command line token in a response, and if those responses are logged, the tokens end up in the logs. The company suspects a recently patched vulnerability was the way in, and says its official 1.107.0 source tag on GitHub does not contain the malicious files. Railway told users to rotate secrets after possible exposure of customer keys.

Why it matters for developers: AI gateways sit next to every model key a team owns, which makes them a prime target. The incident also shows a new leak path, where agent output containing secrets lands in logs that attackers can read.

What to do: if 1.107.0 touched any environment, treat it as compromised. Microsoft advises not running Python or pip inside a suspect environment to check. Rotate every credential it could reach, pin known good versions, and scrub logs that capture agent responses.

Building with AI? See this week's hot AI repos and how to use each one.