Microsoft Says Deleting the Tampered LiteLLM Package Is Not Enough to Recover

Microsoft says the compromised release of LiteLLM 1.107.0 ran a credential collector whenever Python started in an affected environment, and that deleting the package is not enough to recover. The company's threat intelligence team published its analysis on Oct. 23, 2026.

LiteLLM is commonly deployed as a gateway between applications and AI model providers. In that position, Microsoft says, LiteLLM may hold model-provider API keys and workload identities. The same package also sits on developer workstations, build agents, test systems and containers. Microsoft's analysis says exposure was therefore not limited to gateway hosts: the tampered release placed startup files in the Python environment's library directory rather than in the application folder, so the collector ran through Python's ordinary startup even where LiteLLM was never used.

The release reached the Python Package Index on Oct. 21, 2026, and shipped in official container images. The collector, Microsoft says, was built to gather authentication material from developer and AI tools, cloud and source-control credentials, browser credential stores, process environment variables and private keys. It encrypted what it gathered and tried to send it to an attacker-controlled server. A second path on Unix systems was built to fetch and run further code, which Microsoft records as not confirmed.

Microsoft's guidance for organizations that installed or mirrored the version is to find every copy, including package caches and internal mirrors, and to rebuild the affected environments rather than delete the application directory. Microsoft says credentials reachable by the affected identity should be rotated from a machine known to be clean, and that investigators should not run Python or pip inside a suspect environment, because that can itself start the collector.

Microsoft reports the LiteLLM maintainers' account of the origin: stolen developer GitHub credentials were used to change the release workflow and point it at a lookalike repository. Microsoft says it has not independently determined how the attacker first reached the upstream environment. Defender Antivirus signatures and Defender for Endpoint alerts for the release were available as of Oct. 22, 2026, and Microsoft notes detection names may change.