On 21 October, version 1.107.0 of LiteLLM — a model-gateway library that sits in front of API keys for OpenAI, Anthropic, and dozens of other providers — appeared on PyPI with a backdoor inside. Malicious wheels and a Docker startup hook collected environment variables and credentials and shipped them out. Total exposure: about 100 minutes. The entry point had been sitting there since May, when a master access token leaked into a public GitHub repository and quietly never worked for the maintainer again — it just worked for someone else. If your team pulled the package in that window, the attacker got a bag of keys that unlocks your model providers, your databases, and often everything those environment variables touch.
Not an incident. A pattern.
The LiteLLM backdoor got the headlines because the target was the plumbing of the AI ecosystem itself. But look at the month around it. Earlier in October, the Shai-Hulud npm worm — the self-replicating campaign that has been sweeping the JavaScript ecosystem since September — resurfaced in packages belonging to Tensorlake, and researchers noted the latest variant carried a destructive switch: logic that could wipe files if trigger conditions were met. Separately, a campaign tracked as GhostAction has been injecting malicious GitHub Actions workflows into legitimate repositories, quietly exfiltrating CI secrets — the same secrets that sign your deploys and open your cloud accounts. And on the consumer edge, lookalike installers for developer tools — fake Claude Code setup scripts among them — have been harvesting credentials from people who typed a curl command a little too eagerly.
Different vectors, one design. The AI stack concentrates extraordinary credentials in ordinary places: gateway keys that can spend money across every provider, environment variables holding database URLs, CI secrets with deploy rights, tokens scoped to entire cloud accounts. The supply chain delivers attacker code to exactly those places. And the code does not need to be clever. It needs to run once, for a minute, on a machine that is logged in to everything.
Why AI stacks are worse than what came before
Every software team has a dependency problem; AI teams have three stacked on top of it. First, the credential density: a model gateway is, by design, a proxy for spending. Compromise it and you do not just get data — you get metered access to frontier models billed to someone else's card, which is precisely what the rented-inference attack campaigns we covered recently rely on. Second, the tooling surface is young and moving fast: more than 30 CVEs landed against MCP servers in the first sixty days of this year, in a protocol that is barely out of kindergarten. New layers ship weekly; review discipline ships rarely. Third, the blast radius is inherited: when your agent runs with write access, a poisoned dependency does not just steal secrets — it acts with your agent's permissions, on your agent's scaffolding, against your actual infrastructure.
The uncomfortable part is the economics. The LiteLLM backdoor cost the attacker nothing but patience — a leaked key in May, months of quiet persistence, one pushed release. Defending against it costs every downstream team a permanent tax: verification, pinning, monitoring. That asymmetry is the whole story of 2026 security, and the supply chain is where it pays best.
The afternoon's worth of fixes
None of what follows is novel in software security. What is new is how few AI teams have applied it to their AI dependencies, because the stack feels like magic and magic does not get audited.
Pin and verify your Python and npm dependencies. Exact versions with hashes in your lockfile, enforced in CI. When 1.107.1 lands as the fix, you want to install the version you vetted, not whatever the tag resolves to on a Tuesday.
Treat model-gateway keys as crown jewels. Separate keys per environment and per service, spend limits on each, rotation on a schedule and rotation on suspicion. A gateway key that can call every provider from one secret is a single point of failure wearing a load balancer's uniform.
Egress-control your build and agent runners. A credential stealer is only as good as its network route. If your CI and your agent hosts can only reach an allowlist of endpoints, the exfiltration step of every campaign above fails loudly or fails silently — either way it fails.
Review workflow changes like the code they execute. GhostAction succeeds because a pull request touching a YAML file looks like chores. A modified GitHub Actions workflow is arbitrary code running with your repository's secrets; give it the same review bar as a change to your auth layer.
Never install by copy-pasting shell into a terminal. The fake installer campaigns work because curl | bash skips every instinct you would apply to a dependency. Fetch installers over verified channels, checksum them, and treat any tool that asks for your API keys on first run with the suspicion you would give a stranger asking for your wallet on first meeting.
Put canaries where the thieves shop. A honeytoken — a fake AWS key or database URL sitting in your CI environment — turns a silent exfiltration into a page from your alerting stack, because only a thief ever touches it.
The LiteLLM window was 100 minutes, and teams that had pinned with hashes were immune even to that. The rest of the month's campaigns were slower and more patient. The supply chain does not need to beat your defenses — it needs to beat your defaults. Set better defaults.
This connects to the rest of the AI security map we have been building: tool poisoning as the new SQL injection, what happens when your agent gets write access, the sandbox that failed quietly, and the CVE spike that supplies this ecosystem its vulnerabilities.