Two hours. The AI supply chain is the new perimeter.

LiteLLM is a library that works as a switchboard between a company’s software and AI models: OpenAI, Anthropic, Google and the rest go through it, with their keys. It is free, it has about 23 million downloads a week according to Datadog, and on Wednesday 21 October a poisoned release came out. According to LiteLLM’s own account version 1.107.0 was on PyPI, the public Python package registry, from 11:39 to 13:23 UTC, and in the official Docker images until 14:20.

In that window, according to Wiz, it was downloaded about 49,000 times. Downloads like these often come from automated systems that update themselves: that is their job. The release carried a program that started every time Python did and collected everything it found: AWS, Google Cloud and Azure credentials, OpenAI and Anthropic keys, SSH keys, and Claude, Codex, Cursor and Copilot sessions.

It was LiteLLM’s second attack of this kind in 2026; the first was in March. The cause, according to the company, was three developers’ GitHub credentials in the wrong hands, one of them belonging to one of the organisation’s two owners. How they got out is still a hypothesis.

For twenty years security was about walls: firewalls, remote access, employee passwords. October’s attacks touched no wall. They came in with the software companies install every day, and they worked with the company’s keys.

The same month, StepSecurity reconstructed the tensorlake case, an npm package: the malware used stolen GitHub tokens to write Claude Code and VS Code configuration into every repository it could reach. Each time a developer opened the project, their coding agent ran the malware again. And if someone revoked the stolen token, the program wiped the user’s home folder.

On 13 October an npm publishing flaw went public: more than 1,500 packages, with over 10 million downloads, could be published by anyone who re-registered the name of an abandoned repository. GitHub had closed it on 2 October. The people who found it say they saw no exploitation.

The map has a single point where a person decides: the gate, where someone sets what gets in, at which version and with which permissions. Everything after it runs on its own, with your keys. That is where to look.

The instinctive reaction to an attack like this is “update everything, now”. That is exactly the behaviour LiteLLM 1.107.0 exploited: the systems that always install the latest release took it first. The opposite reaction, never updating, leaves open the holes that fixes close.

The answer is a rule, not a reflex. Versions are pinned and changed when someone decides, after a check. Security fixes get a fast lane with a written deadline. And the most valuable keys never sit where freshly downloaded code runs.

You do not need technical skills to ask them. You need answers with a name and a date.

1. 01

   Do we use LiteLLM or another gateway for AI models? Which version, and who installed it?

   If the answer is “I don’t know”, that is already an answer: nobody holds the list of what runs.

2. 02

   Are library versions pinned, or do they update themselves?

   Pinned means they change only when someone decides and records it.

3. 03

   Where do the AI service and cloud keys live, and who can read them?

   A dedicated vault, limited access, different keys for different environments. Never in the code, never in the logs.

4. 04

   Which coding-agent configuration files are in the repository, and who approves them?

   Files such as .claude/settings.json or .vscode/tasks.json run commands. Treat them as code.

5. 05

   If a key is stolen tomorrow, how fast do we replace it?

   In October the first stolen credentials were used about four and a half hours after the theft.

6. 06

   Who tells us when a component we use is compromised?

   You need a person or a service watching for it. Reading about it in the news the next day is late.

1. [1]LiteLLM: Contained, Oct 21, 2026 LiteLLM release v1.107.0 Compromised. docs.litellm.ai
2. [2]Wiz Research: LiteLLM compromised, steals credentials (21 October 2026). www.wiz.io
3. [3]Datadog Security Labs: LiteLLM supply chain compromise (21 October 2026). securitylabs.datadoghq.com
4. [4]StepSecurity: tensorlake npm compromised (8 October 2026). www.stepsecurity.io
5. [5]Help Net Security: SlugFest, an npm Trusted Publishing flaw (13 October 2026). www.helpnetsecurity.com
6. [6]GitHub Changelog: unvalidated npm trusted publishing configurations now expire (2 October 2026). github.blog