Muscle AI (@themuscleai) on X

What it claims

LiteLLM 1.107.0, published to PyPI on 21 October 2026, was built from attacker-controlled code by the project's own release pipeline. It was not uploaded from outside. The post is by Muscle AI (@themuscleai), not "Muse AI" as the existing summary has it. It says Socket flagged the release 7 minutes after publication, and PyPI quarantined it about 1 hour 43 minutes after. The post calls this the second LiteLLM compromise of 2026: a TeamPCP campaign in March 2026 hit versions 1.82.7 and 1.82.8. It puts LiteLLM at about 92M monthly downloads and says it sits in most agent harness dependency trees.

How it works

The attacker used stolen GitHub CLI OAuth tokens from three engineers' accounts. They pushed a trojanized commit chain through a lookalike repository. The official wheels and Docker images were then built from that chain, so the compromise came through trusted publishing infrastructure.

The payload was a file named cook.pth. Python runs .pth files at interpreter startup, so the code ran before any user code and without any import litellm. It collected cloud credentials, private keys, browser data and AI dev-tool auth files. It then sent them as a tarball in a POST to an attacker endpoint. The post says .env files and browser profiles are exactly where cook.pth looked.

How to use it

The author gives a reason for each of the five defences:

• Hash pinning: a hash-locked lockfile rejects the malicious artifact even when a version pin alone does not.
• Per-tool keys with spend caps: these limit what a stolen key costs.
• A one-day cooling period: this would have avoided the whole incident, which ended within about 2 hours.
• Secrets outside the startup path: secrets should be kept where a startup hook cannot read them.
• Outbound monitoring: an unexpected POST from a build box is the signal to look for.

The post also cites a founder who urged users to switch to their own router. That founder's requirements file pinned litellm==1.76.1 exactly, and the post credits that pin, not the choice of library, for keeping their users safe.

Limits

The post is an X thread with no links to an advisory, indicators of compromise, the attacker endpoint or the lookalike repository name. It does not say how to detect past exposure or which credentials to rotate first. It calls 1.107.0 a "same-version malicious release" without explaining that phrase. It also says the Docker images were compromised, but none of the five defences covers image pinning. All figures are the author's and are not sourced.