LiteLLM release pipeline compromised to distribute info-stealer malware

# LiteLLM release pipeline compromised to distribute info-stealer malware

https://gcdradar.vercel.app/incidents/litellm-release-pipeline-compromised-to-distribute-info-stea · AIR-2026-1471 · closed 2026-11-05

- Lane: Supply chain
- Severity: 3 (Confirmed exploitation)
- Fix status: Fix status unknown
- First reported: 2026-10-22
- AI role: Attack on AI
- Products: LiteLLM

## Summary

Threat actors compromised LiteLLM release pipelines on PyPI and Docker Hub to distribute malicious packages containing info-stealer payloads. The malware targets environment variables, credentials, and sensitive secrets on affected systems.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-22: LiteLLM release pipeline hacked to distribute info-stealer malware (https://bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware)

## Sources

- 2026-10-22 BleepingComputer: LiteLLM release pipeline hacked to distribute info-stealer malware https://bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.