Software Supply Chain Attack on LiteLLM: Overview and Response Guidance

Posted on October 21, 2026  •  2 minutes  • 241 words

Note) This post is a direct translation of this post .

On October 21, 2026, malicious code was injected into the PyPI package litellm.

This article goes into detail on this malicious package based on information we observed and analyzed on the analysis infrastructure behind Takumi Guard, focusing on its impact as well as the countermeasures to take.

The purpose of this article is to help readers understand the situation and respond; it is not intended to assist or encourage any illegal activity.

Some descriptions may contain inaccuracies. Please bear in mind that we have prioritized getting this report out quickly.

TL;DR — Response Guidance

• If you ran pip install litellm==1.107.0, your environment may be compromised. The safe version is 1.106.2.
• The payload is an infostealer that harvests secrets across 16 categories — including SSH private keys, cloud credentials (AWS/GCP/Azure), browser-stored passwords, AI development tool credentials, environment variables, Kubernetes service account tokens, and LiteLLM database credentials — encrypts them with AES-256-CBC + RSA-OAEP, and exfiltrates them via HTTP POST to http://www[.]litellm[.]dev/healthcheck. It also installs a persistent daemon that fetches and executes remote code from a GitHub-configured C2 domain.
• If you may be affected, rotate your SSH keys, AWS/GCP/Azure credentials, Kubernetes config, Docker config, npm/PyPI tokens, GitHub CLI tokens, browser-stored passwords, AI tool credentials (Claude/Cursor/Copilot/Gemini/Codex), GPG private keys, and TLS private keys immediately.

How the Compromise Works

We are currently investigating the detailed behavior and will update this post with details later.