LiteLLM 1.107.0 Hacked: What Indian AI Teams Must Check

In short: On 21 October 2026, attackers published a poisoned LiteLLM version 1.107.0 to PyPI and Docker registries for a few hours. It carried malware that steals credentials. Teams that installed or pulled LiteLLM without a pinned version during that window should check their systems, clean or rebuild them, and rotate every API key the servers could reach.

What Happened

LiteLLM is a popular open-source tool that lets applications call many AI model providers through one interface, often used as a proxy that stores provider API keys. According to the LiteLLM security incident notice dated 21 October 2026, a malicious version 1.107.0 was published through its own release pipeline after attackers used compromised developer credentials. Datadog Security Labs also reported the compromise of version 1.107.0 on PyPI and container registries, following multiple maintainer account compromises.

The LiteLLM notice gives these exposure windows, all on 21 October 2026 (UTC):

• PyPI: litellm==1.107.0 was available from 11:39 to 13:23 UTC.
• Docker Hub: the tags v1.107.0, latest, main-latest and main-stable pointed to a compromised image from 11:46 to 14:20 UTC.
• GitHub Container Registry: the same tags for the litellm, litellm-database and litellm-non_root images were affected from 11:46 UTC until they became unavailable by 13:51 UTC.

LiteLLM says the official source code tag on GitHub did not contain the malicious files, which were built from a lookalike repository, and that customers using its private enterprise registry were not affected. The notice describes the malware as code that steals credentials and loads remote code execution tools.

Who Is Affected

According to LiteLLM, you are affected if you installed LiteLLM through pip without pinning a version between 11:39 and 13:23 UTC, or ran one of the affected Docker tags between 11:46 and 14:20 UTC on 21 October 2026. LiteLLM says all versions before 1.107.0 are considered safe and recommends pinning to 1.106.2 or another version published before the incident.

In India, this matters to any company, startup or department that has built a chatbot, AI agent, document assistant or internal AI tool using LiteLLM, directly or through another product. Automated builds are the biggest risk: a CI pipeline or server that pulls "latest" during a rebuild could have picked up the bad version without anyone noticing.

What It Means for Indian Businesses

AI proxies often hold the most valuable keys a company has: paid model provider keys, database passwords and cloud credentials. If those leak, attackers can run up large bills, reach customer data or move into other systems. Because the malware could run every time Python started on an affected host, simply upgrading may not be enough.

This incident is also a reminder that AI tools are now part of the software supply chain and need the same controls as any other dependency. CERT-In has already flagged AI agents as an attack surface, as covered in our post on the CERT-In AI agents advisory. If you confirm a compromise, check your incident reporting duties with your adviser; our CERT-In 6-hour reporting checklist explains the general process. This article is general guidance, not legal advice.

What to Do Now

1. Find every LiteLLM install. Check servers, containers, CI pipelines and developer machines, and run pip show litellm or check image tags and digests to see which version is in use.
2. Check for the indicators. Search for litellm-1.107.0.dist-info, cook.pth, cook.py and sitecustomize.py in site-packages, as listed by LiteLLM, and remember that finding nothing does not prove a host is clean.
3. Do not just upgrade in place. LiteLLM warns against running pip install first on an affected host, because Python startup can re-run the malicious files; rebuilding images and environments from scratch is the preferred fix.
4. Pin a safe version. Reinstall LiteLLM pinned to 1.106.2 or another version published before the incident, and stop using floating tags such as latest in production.
5. Rotate every reachable secret. Replace model provider API keys, LiteLLM master and virtual keys, database passwords, cloud roles and any other secrets the affected hosts could access.
6. Review logs and bills. Look for unusual use of cloud credentials and model provider keys from outside your infrastructure since 21 October, and watch usage dashboards for unexpected spikes.
7. Tighten your supply chain. Pin dependency versions, verify image digests, restrict who can approve releases in your own pipelines and keep secrets out of logs.

For the longer term, a routine patch and dependency management process makes it easier to know what is installed where when the next incident happens.

Frequently Asked Questions

Which LiteLLM versions are safe?

LiteLLM says all versions before 1.107.0 are considered safe and recommends pinning to 1.106.2 or another version published before the incident. Check the official notice for any later updates.

We use LiteLLM but did not update on 21 October. Are we affected?

If your install was pinned to an earlier version and no build pulled a new one during the exposure window, you are likely not affected. Confirm by checking versions and image digests on every host.

Is rotating API keys really necessary?

If an affected version ran on a host, yes. The malware was designed to steal credentials, so any key the host could read should be treated as exposed.

How Affix Center Can Help

Affix Center helps businesses and government departments in Mumbai and across Maharashtra build and secure AI applications. Our data and AI team can review how your AI tools are built and deployed, and our cybersecurity team can help check affected systems, rotate secrets and review logs.

If you are not sure whether your AI applications were exposed, contact our team today.