Poisoned LiteLLM Release Steals Credentials Just by Starting Python

On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to the Python Package Index (PyPI) and distributed through official container images. The malicious package added files that Python could run during normal start-up. An application did not need to import LiteLLM for the payload to execute: simply starting Python in an affected environment could be enough.

Microsoft analysed two execution paths. One was a credential collector launched through a path extension, and the other was a Unix-oriented loader kept in place through site-specific configuration. The collector targeted authentication material across developer tools, AI applications, cloud environments, browsers and infrastructure. A separate database module tried to read selected credential and model-configuration records from the LiteLLM proxy. On Windows and macOS, endpoint observations matched the collector's discovery, encryption and outbound-connection behaviour. In one Windows case, a routine Python command to install an unrelated dependency triggered the collector.

LiteLLM is often used as a gateway between applications and model providers, so it may hold provider API keys, database connection strings, workload identities and routing configuration. It is also used on developer workstations, build agents, test systems and containers, which widened potential exposure. Investigators should not start Python or pip inside a suspect environment to check for the package. Removing the package or a release tag is not enough: organisations must also deal with the affected Python environment, any surviving processes, and credentials the compromised identity could reach.