Supply Chain Attack Compromises LiteLLM PyPI Package, Distributing Credential‑Stealing Malware to Millions of Developers

What happened

On October 21 2026 the LiteLLM maintainers discovered that their CI/CD pipeline had been compromised. Attackers pushed a malicious version 1.107.0 to PyPI and to Docker Hub/GHCR. The wheel contained three hidden files that execute on Python start‑up, harvesting cloud and AI credentials. The compromised Docker images were removed within hours after detection.

Why it matters for trust and compliance

• The breach underscores the importance of a control‑assurance program that continuously validates third‑party software integrity, records evidence of package signing, and maintains an audit‑ready trail of supply‑chain risk assessments.
• Provides concrete evidence for the ‘software‑supply‑chain integrity’ control objective across frameworks.
• Enables organizations to demonstrate due‑diligence and continuous monitoring of third‑party releases during audits.

Who is affected

Recommended actions

1. Block and remove LiteLLM version 1.107.0 from all internal repositories.
2. Scan environments for the malicious `cook.pth`, `cook.py`, and `sitecustomize.py` files.
3. Implement signed package verification and SBOM checks for all third‑party dependencies.
4. Integrate automated monitoring of upstream releases into your vendor risk management workflow.