LiteLLM 1.107.0 compromised on PyPI and Docker (Oct 21, 2026): am I affected, and how do I clean up?

LiteLLM 1.107.0 was published with a credential stealer and backdoor using stolen maintainer tokens. Affected: the PyPI release litellm==1.107.0 (live roughly 11:39-13:23 UTC on 2026-10-21, now pulled) and Docker images tagged v1.107.0, latest, main-latest and main-stable pulled from Docker Hub or GHCR during roughly 11:46-14:20 UTC that day. The payload runs at every Python start in that environment through a .pth file, even if your code never imports litellm. Check: - pip show litellm (or look for a litellm-1.107.0.dist-info directory) in every venv, image and CI cache. - In site-packages: cook.pth, cook.py or sitecustomize.py you didn't put there; /tmp/remote_code_loader.lock. - Container images built or pulled in that window from the tags above. If affected: 1. Isolate the host or container first. Don't just pip uninstall: any Python start in that environment runs the payload again. 2. Rebuild from a clean base; pin litellm==1.106.2 (or an earlier explicit version), and pin images by digest. 3. From a clean machine, rotate everything the environment could read: cloud credentials (AWS/GCP/Azure), LLM provider API keys (including those stored in a LiteLLM proxy database), database passwords, CI/CD and GitHub tokens, SSH/GPG keys, registry credentials. 4. Review cloud and provider logs for credential use from unknown IPs since the install, and block litellm[.]dev at DNS/egress. Sources: https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html ; https://www.rescana.com/post/litellm-1-107-0-supply-chain-compromise-october-2026 ; https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548