Executive Summary
A compromised LiteLLM release was distributed through package and container registries after attackers obtained an exposed key, reportedly enabling credential and secret theft. Teams operating LLM applications or AI agents should treat dependency provenance and secret-management controls as priorities.
What Happened
A poisoned LiteLLM 1.107.0 release was uploaded to PyPI and container registries after attackers obtained an exposed key. The package reportedly included an infostealer and remote-access trojan capable of stealing browser credentials, cloud credentials, CI secrets, and API keys for multiple LLM providers.
Affected Products
- LiteLLM 1.107.0
- PyPI
- container registries
Vulnerability / Attack Technique
AI software supply-chain compromise using an exposed key
Technical Mechanism
Attackers obtained an exposed key and used it to upload a poisoned LiteLLM 1.107.0 release to PyPI and container registries. The package reportedly included an infostealer and remote-access trojan capable of stealing browser credentials, cloud credentials, CI secrets, and API keys for multiple LLM providers.
AI Security Category
LLM03:2025 Supply Chain
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
This incident shows how compromise of an AI application dependency can expose credentials and provider API keys used by agents and LLM applications. Teams should maintain an inventory of AI dependencies and LLM integrations, enforce trusted build and registry practices, and detect leaked or abused secrets.
Recommended Controls
- Maintain an AI-agent SBOM covering LiteLLM, transitive dependencies, container images, and LLM-provider integrations.
- Pin and verify dependency versions and container image digests, and restrict production deployments to approved registries.
- Protect package publishing and CI/CD credentials with hardware-backed or short-lived credentials, MFA, least privilege, and rotation.
- Scan source code, CI systems, containers, and runtime environments for exposed cloud credentials, CI secrets, and LLM API keys.
- Monitor dependency releases and provider API activity for unexpected changes, unauthorized access, and anomalous credential use.
Related RealGround Service
AI Agent SBOM and LLM Mapping · or start with the free AI Agent Security Scanner.
Sources
The Register: https://www.theregister.com/security/2026/10/26/litellm-supply-chain-attack-started-with-an-exposed-master-key/5305544
Summary and analysis written by RealGround from the source above; last updated 2026-11-01.