A malicious litellm release stole developers' credentials

On 21 October, JFrog Security Research reported that version 1.107.0 of litellm, a widely used Python library for connecting applications to language models, contained malicious code. According to JFrog, all seven packages published on PyPI carried three extra files that run when Python starts, steal credentials and open a channel to run remote code every hour, even if the application never imports litellm. The source code did not contain them, so reviewing it was not enough. The official Docker image was affected too.

PyPI and Docker Hub have removed the release, and LiteLLM told JFrog on 22 October that the incident is contained. It is the second litellm hijacking in 2026; JFrog sees no evidence that the two are linked and says it does not yet know how the build was tampered with. This is the analysis of a company that sells detection for this kind of attack.