Verified Findings

None

Contradictions / Caveats

• UNKNOWN: Official release pipeline published malicious litellm 1.107.0; all seven PyPI wheels and official Docker/GHCR mutable tags were affected during bounded windows; official GitHub source tag was clean; private enterprise registry stated unaffected.
• Evidence boundary: Does not prove affected-system/victim count, downstream package count or later credential misuse.

Open Follow-up

• OPEN [HIGH]: AFFECTED_SYSTEM_DENOMINATOR — No reliable public count of hosts/environments that installed and executed LiteLLM 1.107.0 or affected container tags during the compromise window.
• OPEN [HIGH]: DOWNSTREAM_PROPAGATION — No verified public denominator/count for internal mirrors, derived images, build outputs or downstream packages incorporating affected artifacts.
• OPEN [MEDIUM-HIGH]: CREDENTIAL_MISUSE_ATTRIBUTION — Credential-stealing capability and release-workflow credential abuse are established, but downstream stolen-secret reuse and October actor identity are not quantified/attributed.

Sources

1. LiteLLMhttps://docs.litellm.ai/blog/security-incident-oct-21-2026