Source: CERT-In advisory CIAD-2026-0053 • Date: 23 October 2026 (updated 24 October 2026)
The LiteLLM compromise, flagged by CERT-In on 23 October 2026, affects LiteLLM 1.107.0 on PyPI and related Docker images, so anyone who installed or ran them should check their systems and rotate credentials where exposure is plausible.
LiteLLM compromise key facts
- CERT-In advisory CIAD-2026-0053 was issued on 23 October 2026 and updated on 24 October. It does not state a severity and lists no CVE.
- LiteLLM is a Python SDK and proxy for connecting apps to multiple LLM provider APIs.
- Affected: LiteLLM 1.107.0 from PyPI, plus Docker images on GitHub Container Registry and Docker Hub (the advisory does not list image tags).
- The attacker reportedly used a lookalike repository to trigger a release workflow and injected three files (cook.pth, cook.py, sitecustomize.py) into site-packages.
- Because of how these files work, malicious code may run whenever Python starts, even if LiteLLM is never imported.
What the malicious code does
- Steals credentials: browser sessions, SSH and GPG keys, AWS, Azure and Google Cloud credentials, environment variables, CI/CD secrets, repository tokens, and Cursor and GitHub Copilot tokens.
- On LiteLLM proxy setups, it may reach the database through DATABASE_URL and expose upstream LLM provider API keys.
- A background process periodically checks an attacker-controlled GitHub repository and may run code fetched from it.
What CERT-In recommends
- Search dependency files and software inventories for LiteLLM 1.107.0, and look for the three files above in site-packages.
- Isolate suspected hosts and containers, keep logs, and rebuild containers from a verified clean image.
- Reinstall a verified clean release; the analysis names 1.106.2 as clean, but CERT-In says to verify its integrity before pinning it.
- Rotate cloud, SSH and GPG keys, AI tool tokens, CI/CD and repository secrets and LLM provider keys, including the proxy master_key and salt_key, from a clean environment.
LiteLLM compromise FAQ
What is the LiteLLM compromise?
It is a supply-chain attack on LiteLLM 1.107.0 on PyPI and related Docker images, as described in CERT-In advisory CIAD-2026-0053.
Which LiteLLM version is affected?
Version 1.107.0 from PyPI, and Docker images on GitHub Container Registry and Docker Hub. The advisory names 1.106.2 as clean but says to verify it.
What should I do first?
Check whether 1.107.0 or the affected images were installed or run, isolate those systems, and rotate the credentials listed above from a clean machine.
Related: Indian Government Issues Security Warning for Windows PC Users
Last updated: 25 October 2026
