Executive Summary
On October 21, 2026, the popular Python library LiteLLM (version 1.107.0) was compromised on PyPI and Docker Hub via a hijacked GitHub release workflow. The attacker utilized a leaked GitHub organization owner token to point the project's trusted CI/CD pipeline toward a lookalike repository (Berri-AI/litellm). This resulted in the distribution of backdoored wheels and container images containing a credential stealer named 'privcollect' and an hourly remote code loader (RAT).
The technical impact is significant because the malware uses Python startup hooks (.pth files and sitecustomize.py), meaning the payload executes automatically whenever the Python interpreter starts in the infected environment, regardless of whether LiteLLM is explicitly imported. The malware targets highly sensitive data, including cloud provider keys (AWS, GCP, Azure), AI tool credentials, developer SSH/GPG keys, and LiteLLM proxy database credentials. While the release was quarantined within two hours, approximately 49,000 downloads occurred, necessitating immediate rotation of all credentials handled by affected systems.
This incident highlights the criticality of protecting GitHub CLI OAuth tokens and managing CI/CD secrets. The activity shows similarities to previous compromises by suspected TeamPCP, although no direct attribution has been confirmed for this specific campaign. Affected organizations must manually remove dropped files as standard uninstallation of the package does not remove the persistent startup hooks.