What happened
On October 21, 2026, attackers used stolen maintainer tokens to push LiteLLM version 1.107.0, the popular open-source gateway for calling many LLM providers, to PyPI and Docker Hub/GHCR, built from an attacker-controlled repository. The malicious build ran a credential stealer at every Python start, collecting cloud, Kubernetes, SSH, browser and AI coding tool credentials and dumping the provider keys stored in the LiteLLM proxy database. LiteLLM pulled the artifacts within hours (PyPI 11:39 to 13:23 UTC), and Microsoft, JFrog and Socket published analyses. (LiteLLM security incident notice, Oct. 21, 2026)
What it means for Canada: our assessment
No Canadian victims are reported, so this is an assessment. Canadian AI teams, startups and banks' internal AI platforms that route model calls through a self-hosted LiteLLM proxy, and that pull the latest tag or unpinned versions, could have installed the bad build during the window and lost every provider key, cloud role and database password the host could reach.
- Sectors
- AI startups · Financial institutions' internal AI platforms · SaaS and software firms · Agencies building agents for clients
- Tools involved
- LiteLLM 1.107.0 (PyPI wheels) · LiteLLM Docker images tagged v1.107.0, latest, main-latest, main-stable · OpenAI, Anthropic, Azure, Bedrock and other provider keys stored in the proxy
- Canadian rules
- PIPEDA breach reporting to the OPC if personal data was reachable from affected hosts
Quebec Law 25 confidentiality incident register and reporting
OSFI B-10 and B-13: third-party and software supply chain risk for federally regulated financial institutions
Assessment, not documented exposure. Based on LiteLLM's wide use as an LLM gateway and the stealer's targeting of cloud and AI credentials, not on any documented Canadian incident.
Takeaways for Canadian businesses
- BusinessSearch lockfiles, container registries and CI logs for litellm==1.107.0 or images pulled from Docker Hub or GHCR on October 21 using the latest, main-latest or main-stable tags.
- BusinessOn any affected host, do not run pip first: delete cook.pth, cook.py, sitecustomize.py and their __pycache__ files, and kill the detached Python process holding /tmp/remote_code_loader.lock, as LiteLLM advises.
- BusinessRebuild from scratch pinned to litellm==1.106.2, and assume exfiltration succeeded if the host had internet access.
- BusinessRotate the host's IAM role, every provider key in the LiteLLM proxy database, the master and virtual keys, the DATABASE_URL password and any secret in process environments.
- BusinessPin AI dependencies by version and hash and stop deploying the latest tag, so a hijacked release cannot reach production automatically.
For the Canadian AI sector
The AI tooling layer is now a prime supply chain target because one proxy host holds keys to many model providers. Canadian AI teams should treat their LLM gateway like a payment system: pinned, reviewed and isolated.
Written by AgentsNorth from the source below. General information, not legal or security advice.