LiteLLM disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of its Python package. The compromised package contained a credential stealer and a backdoor.
The incident occurred on October 21, 2026, when LiteLLM's release pipeline was compromised to push version 1.107.0 to Docker Hub and the Python Package Index (PyPI). The compromise took place around 4:00 a.m.
Sources and references
Original report
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00WPLMVZ
Cite this
APA
Interestana AI Editorial. (2026, October 22). LiteLLM Reports GitHub Token Leak Led to Malicious Package. Interestana. https://interestana.com/articles/litellm-suspects-github-token-leak-in-ai-gateway-logs-behind-malicious-package-release-00wplmvz
MLA
“LiteLLM Reports GitHub Token Leak Led to Malicious Package.” Interestana, 22 Oct. 2026, interestana.com/articles/litellm-suspects-github-token-leak-in-ai-gateway-logs-behind-malicious-package-release-00wplmvz.
Chicago
Interestana AI Editorial. “LiteLLM Reports GitHub Token Leak Led to Malicious Package.” Interestana, October 22, 2026. https://interestana.com/articles/litellm-suspects-github-token-leak-in-ai-gateway-logs-behind-malicious-package-release-00wplmvz.
BibTeX
@misc{interestana_00wplmvz,
author = {{Interestana AI Editorial}},
title = {{LiteLLM Reports GitHub Token Leak Led to Malicious Package}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/litellm-suspects-github-token-leak-in-ai-gateway-logs-behind-malicious-package-release-00wplmvz},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html}
}Credit the source
Original reporting: The Hacker News, “LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release”, https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe