Security · October 25, 2026
Also published in Svenska, Português (Brasil)
Malicious Program Found in LiteLLM Distribution
A malicious program was discovered in the legitimate distribution package of the open-source software LiteLLM, which is designed for generative AI. If the malicious package is installed, there is a risk of credential theft and unauthorized code execution, leading to serious issues.
The developer revealed on October 21, 2026, local time, that the version LiteLLM 1.107.0 had been compromised. This breach involved the software's release process, constituting a so-called software supply chain attack, where malicious software is spread through legitimate distribution channels. A supply chain attack had also occurred in March, but it was related to a different issue.
In addition to seven types of wheel files distributed via the Python package repository service PyPI, official container images distributed on Docker Hub and GitHub Container Registry were also affected.
According to JFrog, which discovered and reported the issue, the compromised package contains code for credential theft and the ability to execute externally sourced code. It was also exploiting a mechanism that allows the unauthorized code to run automatically at Python startup, even if the application does not load LiteLLM.
The malicious program is equipped to steal a wide range of secret information, including credentials for cloud services, SSH private keys, credentials stored in browsers, and tokens from development environments. There is also confirmation that it can retrieve API keys for generative AI services from the database used by LiteLLM.
Other recent security issues mentioned include unauthorized code in the security scanner Trivy, a remote code execution vulnerability in the API client generation tool Orval, a directory traversal vulnerability in WinRAR that has been patched, and several vulnerabilities in the Linux kernel added to a list of exploited issues by U.S. authorities.