The facts

  1. The vendor identifies all seven PyPI wheels for 1.107.0 published between 11:39:51 and 13:23 UTC on 21 October as compromised. [1]

  2. Affected Docker Hub tags included v1.107.0, latest, main-latest and main-stable during the 11:46:56–14:20 UTC exposure window. The corresponding affected GHCR tags were removed at 13:51 UTC; these are historical exposure windows, not a claim that the tags remain malicious. [1]

  3. LiteLLM says the source-code v1.107.0 tag was clean and its private enterprise registry was unaffected. A clean source tag does not establish that a downloaded build artifact was safe. [1][2]

  4. The vendor’s 23 October postmortem and Upwind’s separate 26 October analysis describe a hijacked release pipeline. Upwind participated in identifying the incident; its analysis is separate from the vendor’s account, but it is an involved security company. [2][3]

Still unconfirmed

  • The number of affected installations and the extent of actual credential theft are not established.
  • Public download totals do not establish a victim count.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 11:28 UTC.

  1. Security incident: October 21, 2026

    LiteLLM · Primary source · 21 Oct 2026

    Actual vendor incident notice read, including artifact-specific UTC windows and remediation. An initially recommended recovery version is not represented as the latest release today.

  2. October 21 security incident: attack-chain postmortem

    LiteLLM · Primary source · 23 Oct 2026

    Later vendor account supersedes preliminary explanations. This shares ownership with source 1.

  3. LiteLLM 1.107.0 supply-chain attack: pipeline hijack

    Upwind · Reporting · 26 Oct 2026

    Lidor Machluf’s actual analysis was read. Upwind is an independently owned commercial security company that participated in discovery; it is not an uninvolved news agency.

Report a factual error