<![CDATA[LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release]]>LiteLLM has disclosed that attackers compromised multiple independent security controls in order to publish a malicious version of its Python package, which bundled a credential stealer and a backdoor.

The compromise of LiteLLM's release pipeline occurred on October 21, 2026, at approximately 4:00 a.m., when a malicious build was pushed as version 1.107.0 to both the Docker Hub registry and the Python Package Index (PyPI).

The company suspects that a leaked GitHub token, possibly exposed through AI gateway logs, played a role in the breach. The incident is notable because it required bypassing several separate safeguards rather than exploiting a single weak point.

  • The malicious release was published as version 1.107.0
  • Distribution channels affected: Docker Hub and PyPI
  • The package contained both a credential stealer and a backdoor

Users who installed or pulled LiteLLM version 1.107.0 from either channel around the time of the incident should treat any credentials accessible to that environment as potentially exposed and rotate them as a precaution.

Source: The Hacker News

Did your organization pull LiteLLM 1.107.0 from PyPI or Docker Hub, and if so, what steps are you taking to verify and rotate exposed credentials?

]]>https://xploitlk.com/topic/786/litellm-suspects-github-token-leak-in-ai-gateway-logs-behind-malicious-package-releaseRSS for NodeTue, 27 Oct 2026 07:22:32 GMTSun, 25 Oct 2026 10:30:18 GMT60