TI Mindmap HUB
Threat Intelligence Report

LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials

๐Ÿ“… October 21, 2026 ๐Ÿ“ฐ socket.dev ๐Ÿ” 0 CVE(s) referenced

LiteLLM 1.107.0 was compromised through a lookalike repository, embedding Python startup malware in PyPI packages and Docker images to steal cloud, developer, browser, database, and AI credentials while enabling remote code execution.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

๐Ÿ” Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

๐Ÿ“Š Visual Mindmap
๐ŸŽฏ IOC Extraction
โš”๏ธ MITRE ATT&CK TTPs
๐Ÿ“ฆ STIX 2.1 Bundle