---
title: "LiteLLM October release-pipeline compromise"
description: "LiteLLM disclosed malicious version 1.107.0 artifacts published after its release pipeline was compromised."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-10-23"
canonical_url: "https://www.ally.security/incidents/litellm-october-release-pipeline-compromise-2026"
markdown_url: "https://www.ally.security/incidents/litellm-october-release-pipeline-compromise-2026.md"
stix_url: "https://www.ally.security/incidents/litellm-october-release-pipeline-compromise-2026/stix.json"
---

# LiteLLM October release-pipeline compromise

Stolen developer credentials enabled a malicious release through the project’s distribution pipeline.

Last modified Oct 23, 2026 · 1 source

## Summary

- **Environment:** LiteLLM release workflows, PyPI and container registries
- **Operational impact:** Poisoned version 1.107.0 artifacts distributed and removed
- **Financial impact:** No incident cost established in the reviewed evidence

## What happened

[LiteLLM](https://www.litellm.ai/) said attackers compromised its release pipeline on October 21, 2026, distributing credential-stealing malware in version 1.107.0. [1](#source-1)

## Impact

All seven PyPI wheels were affected, available from 11:39:51 to 13:23 UTC. Compromised container tags included `v1.107.0`, `latest`, `main-latest` and `main-stable`. LiteLLM said its private enterprise registry was unaffected. No downstream victim total is established. [1](#source-1)

## Timeline

### October 21, 2026 — Malicious release published and removed

The [incident report](https://docs.litellm.ai/blog/security-incident-oct-21-2026) records the publication windows and subsequent removals. [1](#source-1)

### October 23, 2026 — Briefing updated

This briefing was last reviewed and updated on October 23, 2026.

## Threat Group & Attack Vector

LiteLLM said stolen developer GitHub credentials enabled attackers to disable branch protection and change the release workflow. It built poisoned artifacts from an attacker-controlled repository; the official source tag lacked the malware. [1](#source-1)

The project suspected tokens were obtained from internal deployment logs. Entry into that deployment and the suspected vulnerability remained unconfirmed. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- [T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/): poisoned releases reached software distribution channels. [1](#source-1)

## Response

LiteLLM removed affected artifacts and advised rebuilding compromised environments and rotating reachable secrets. It warned that starting Python or pip could rerun malicious startup files. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/litellm-october-release-pipeline-compromise-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised

official · LiteLLM · Oct 21, 2026

<https://docs.litellm.ai/blog/security-incident-oct-21-2026>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: All seven PyPI wheels were malicious and available from 11:39:51 to 13:23 UTC on October 21; affected container tags included v1.107.0, latest, main-latest and main-stable.
2. **Occurred At · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: 2026-10-21
3. **Used Attack Technique · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: https://attack.mitre.org/techniques/T1195/002/
4. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: LiteLLM advised treating affected environments as compromised, rebuilding clean environments and rotating reachable secrets; it warned that starting Python or pip could rerun malicious startup files.
5. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: Poisoned artifacts published and removed
6. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: LiteLLM removed the affected artifacts and said its private enterprise registry was unaffected.
7. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: LiteLLM believed tokens were obtained from logs in its internal deployment; the initial entry into that deployment and the suspected vulnerability remained unconfirmed.
8. **Occurred At · 100% confidence · current**  
   Poisoned artifacts published and removed: 2026-10-21
9. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: LiteLLM said stolen developer GitHub credentials were used to disable branch protection and publish the altered artifacts.
10. **Affected Organization · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: LiteLLM
11. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: The official source tag lacked the malicious files; the compromised workflow built artifacts from an attacker-controlled repository.
12. **Disclosed At · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: 2026-10-21
13. **Resulted In · 100% confidence · current**  
   LiteLLM October release-pipeline compromise: LiteLLM said attackers modified its release workflow and published credential-stealing malware in version 1.107.0 through PyPI and container registries.

</details>