Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

1. #0110.21
   Initial2026-10-21 14:00 · publication time

   Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

   A tampered LiteLLM 1.107.0 release on PyPI shipped a credential stealer and backdoor, prompting maintainers to tell users to pin to 1.106.2 or earlier while an embargoed fix is distributed to enterprise customers.

   Source evidence: abhisek

2. #0210.21
   Remediation2026-10-21 15:28 · publication time

   LiteLLM今年第二次遭投毒：不调用也能偷密钥

   JFrog reported that the supply-chain attack also affected official Docker images and all seven PyPI platform packages; PyPI removed the malicious version and Docker Hub pulled affected images; the release source pointed to a typosquatted repository differing by one hyphen; users are advised to treat credentials as exposed, isolate and rebuild environments, rotate secrets, and roll back to 1.106.2.

   State after update: Malicious LiteLLM 1.107.0 PyPI packages and affected Docker images have been removed; JFrog advises affected users to rotate credentials and rebuild environments, with 1.106.2 confirmed as the safe rollback, while how the malicious code entered the release process remains unclear.

   Source evidence: theblockbeats

3. #0310.22
   Escalation2026-10-22 03:44 · publication time

   【慢雾：LiteLLM 再遭供应链攻击，恶意版本 1.107.0 窃取云凭证与 AI 密钥】

   SlowMist reported that LiteLLM suffered another supply chain attack: malicious version 1.107.0 on PyPI and its Docker images auto-executes on Python startup to steal cloud credentials, AI API keys and SSH private keys and enables remote code execution, with users advised to avoid 1.107.0, rebuild from clean images, rotate credentials and pin 1.106.2.

   Source evidence: foresightnews

All events · Back to the feed