Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
LiteLLM 1.107.0 PyPI package compromised with credential-stealing malware via Python startup hooks
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to PyPI with malicious startup hooks that execute automatically when Python starts, regardless of whether the application uses LiteLLM. The payload collects credentials from developer tools, cloud environments, browsers, SSH keys, and LiteLLM proxy databases across Windows and macOS systems. Microsoft Threat Intelligence warns that simply removing the package is insufficient recovery; organizations must audit affected Python environments, terminate suspicious processes, and rotate all exposed credentials.
The lesson from this incident
Full lessonAttackers published a trojanized version of the widely-used LiteLLM package to PyPI, embedding malicious Python startup hooks that execute automatically at interpreter launch — meaning every Python process on an affected machine runs the payload, not just code that explicitly imports LiteLLM. The malware harvests credentials from cloud environments, browsers, SSH keys, and developer tools across Windows and macOS, dramatically broadening the blast radius beyond the intended application. This incident underscores how implicit trust in public package registries can transform a single compromised dependency into a full credential compromise across an entire developer environment. Because Python startup hooks persist independently of the package itself, simply uninstalling LiteLLM does not remediate the threat, making thorough forensic investigation and credential rotation mandatory.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- malware — LiteLLM 1.107.0 credential collector