Supply chain compromise on October 21, 2026; Datadog Security Labs analysis published October 21, 2026
Malicious LiteLLM 1.107.0 Stole Credentials From PyPI and Docker: Uninstalling Alone Does Not Clean It
Attackers used stolen GitHub CLI OAuth tokens from three LiteLLM engineers to disable branch protections and point the project's own release workflow at a lookalike fork, Berri-AI/litellm, one hyphen away from the real BerriAI/litellm, then published version 1.107.0 through the normal PyPI and Docker channels. Datadog Security Labs reports the malicious release was live for about two hours and was downloaded an estimated 49,000-plus times by SecurityWeek's count. The payload drops three files, cook.pth, cook.py, and sitecustomize.py, into site-packages, so the credential stealer runs every time Python starts, even if LiteLLM is never imported, targeting cloud, developer, AI provider, and browser credentials, with a second component checking hourly for remote code to run. Deleting the LiteLLM package does not remove those files. Datadog's remediation is explicit: remove the three files manually, revert to version 1.106.2, and rotate all affected credentials from a clean machine. It is LiteLLM's second supply chain compromise of 2026, and Datadog says no connection between the two has been established.
Executives
The malicious version came through the project's real release pipeline, with real provenance, after developer tokens were stolen. Provenance alone did not prove safety. Any team that installed LiteLLM updates on October 21 should be treated as holding exposed cloud and AI credentials until rotation is proven complete.
CIO / CISO
This is an AI supply chain incident with a governance core: pin AI infrastructure dependencies, require approval for version changes in gateways that hold provider keys, and protect developer CLI tokens as production secrets. Under the NIST AI RMF, the Manage function now includes proving that a two-hour bad release cannot silently reach production.
Engineers
Check every Python environment, container, and CI runner for litellm 1.107.0 and for cook.pth, cook.py, and sitecustomize.py in site-packages. Remove the files manually, pin litellm to 1.106.2, rebuild images from clean bases rather than uninstalling in place, and rotate cloud, Git, PyPI, and AI provider credentials from a clean machine.
Everyone (non-IT)
If your data science or IT team uses a popular AI plumbing tool, a poisoned update briefly shipped through its official channel this week. The practical lesson is general: updates from the real source can still be hostile, which is why organizations stage and verify them instead of auto-installing.