Global -- A malicious version of LiteLLM, version 1.107.0, was published to PyPI on October 21, 2026. It bundles a credential-stealing infostealer with a remote access trojan (RAT), according to OX Security. It is the second hijacking of the AI gateway this year, and PyPI has since quarantined the release.

Malware hides in the wheel package, not the source repository

The attacker injected the code only into the wheel package, so a review of the repository or the clean source would show nothing wrong. Stolen data goes to litellm[.]dev, a domain the attacker bought that can pass for a legitimate LiteLLM address. In March, versions 1.82.7 and 1.82.8 were compromised in the TeamPCP campaign, but this attack used different tooling and infrastructure.

Installing the package is enough to trigger the malware

The code runs every time Python starts on an affected machine, even if a project never uses LiteLLM. It affects macOS, Linux and Windows. LiteLLM usually sits next to an organization's most valuable AI and cloud credentials, and the malware targets:

• LLM provider API keys and environment variables
• AWS and Azure cloud keys
• GitHub credentials
• Google Chrome profile data and saved passwords
• Command-line history on all three operating systems
• Credentials for Claude Code, GitHub Copilot and Cursor
• Credentials stored in a LiteLLM proxy's own database

The malware has no crypto-stealer component. OX Security reads this as a sign that the attackers want personal and organizational data rather than direct financial gain.

RAT polls its operator every hour for new instructions

The malware is heavily obfuscated across multiple layers. The first two files executed inside the wheel are "cook.py" and "sitecustomize.py". The latter holds all the RAT logic and is not obfuscated. The former contains a base64-encoded script and the infostealer logic.

The malware checks a remote server for configuration every hour. It finds the command-and-control IP address by reading a GitHub URL, then opens the connection. A compromised machine can therefore receive new malicious code at any time.

Teams must pin to 1.106.0 and rotate every reachable secret

OX Security advises checking every environment, container and CI pipeline for version 1.107.0 and pinning LiteLLM to the safe version 1.106.0. Any machine that installed 1.107.0 should be treated as fully compromised and isolated from the network before cleanup. Teams must rotate all secrets that machine could reach, including:

• LLM provider API keys
• Cloud credentials
• Database passwords
• SSH keys
• CI tokens

Operators of a LiteLLM proxy must also rotate the provider keys stored in its database.

OX Security added the release to its malware database. Customers using its VibeSec product are blocked from installing it, and its pipeline scan blocks code that pushes the version as a dependency. The firm also recommends pinning versions and adding a time-based installation delay.