Poisoned LiteLLM 1.107.0 steals secrets across 49k downloads

On 21 October 2026, a poisoned release of LiteLLM, the open-source gateway many teams place between their applications and OpenAI, Anthropic or Google, appeared on PyPI and Docker Hub as version 1.107.0. The release remained available for roughly two hours before it was taken down, and in that window it recorded about 49,000 downloads. According to an analysis published on DEV Community, the package stole keys of every kind that the affected machine could reach. The report adds a detail that makes the impact unusually broad: the malicious code executed even for users whose code never imported LiteLLM, meaning simply having the artifact present in the environment could be enough. The article identifies this as LiteLLM's second supply chain attack of 2026, and it closes with a self-check procedure and a checklist of credentials that affected users should rotate. Because the episode lasted only about two hours, the download count is the main available measure of exposure, and the article does not break down how many of the roughly 49,000 downloads came from PyPI versus Docker Hub. For teams that ran or built on that version in the affected window, the sequence to review is the publication of 1.107.0 on 21 October 2026, its roughly two-hour availability, the roughly 49,000 downloads it accumulated, and the subsequent removal from PyPI and Docker Hub, followed by the guidance to check for the theft and rotate exposed credentials.