Executive Summary
On October 21, 2026, the LiteLLM AI gateway project suffered a significant supply chain compromise affecting PyPI and Docker Hub releases. The attackers gained access by harvesting GitHub CLI OAuth tokens inadvertently logged by Claude Code in a publicly exposed LiteLLM deployment. These tokens allowed the actors to bypass branch protections, force-push malicious code, and hijack the signing workflow to distribute version 1.107.0 containing malicious payloads.
The attack utilized a sophisticated dual-persistence mechanism involving `.pth` files and `sitecustomize.py` to execute a credential stealer named 'privcollect' and an hourly recurring backdoor. Post-exploitation activities included 'LLMjacking,' where attackers utilized stolen AWS credentials to validate access to Bedrock and other AI foundation models. The tactics mirror a March 2026 incident attributed to TeamPCP, although technical differences in the tooling currently prevent definitive attribution.
This incident highlights the severe risks of credential logging in AI workflows and the fragility of supply chain security when manual overrides are granted for rapid deployment. Organizations using LiteLLM version 1.107.0 must immediately isolate affected hosts, rotate all cloud and developer credentials, and audit for unauthorized AWS resource enumeration.