# Contractors Remove Compromised LiteLLM Release

LiteLLM version 1.107.0 was distributed through PyPI and Docker registries on October 21, 2026, carrying credential-stealing malware and a remote-access trojan. Government contractors and other organizations that installed or ran the release may have exposed credentials and secrets, including in Python environments, proxy containers, and CI runners. The signals identify version 1.106.2 as the safe prior release.

- Organizations that used version 1.107.0 should stop deploying it, investigate affected environments, and rotate potentially exposed credentials from a clean environment.
- Contractors handling sensitive credentials or AI workloads can use version 1.106.2 as the identified safe version while assessing affected systems.
- The incident highlights supply-chain risk in software dependencies used across contractor development and deployment pipelines; teams should review dependency integrity controls as part of their response.

**Jurisdictions:** federal, international
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 22, 2026

### Vendors
- BerriAI ()
- Aikido Security ()
- Wiz ()
- Socket ()

### Key Quotes
> Check for /tmp/.pc_once_* (the exfil has already fired if this file exists) and /tmp/remote_code_loader.lock (the C2 daemon ran or is still running if this file exists).
> — Ilyas Makari, Malware hunter at Aikido Security

> Teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners.
> — Socket researchers

### Sources
- [LiteLLM supply-chain attack targets credentials and installs a RAT | Межа](https://mezha.net/eng/news/mezha-c6ce64e47c55cdd32ff8c5ba_litellm_supply-chain_attack) - Mezha.net
- [LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor - HoneyMex Lab](https://honeynet.org.mx/posts/litellm-compromised-in-supply-chain-attack-delivering-credential-stealer-and-backdoor-en) - honeynet.org.mx