LiteLLM 1.107.0 poisoned on PyPI, related Docker images affected
What happened
At 21:44 on October 21, Wiz disclosed that a malicious version of LiteLLM, 1.107.0, on PyPI runs a credential stealer when Python starts, and related Docker images are affected. The program collects browser, cloud service and OpenAI, Anthropic and other credentials, queries the LiteLLM Proxy database directly for provider keys, encrypts them and sends them to attacker-controlled www.litellm.dev/healthcheck. At 22:00, Hacker News reported further that all seven wheels in the release carry the malicious file, which steals credentials even if litellm is never imported, and includes a remote code execution backdoor. Version 1.107.0 has been removed from PyPI.
Written by AI from the coverage · updated 47 minutes ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pagePickLiteLLM 1.107.0 on PyPI tampered with credential stealer and backdoor
LiteLLM 1.107.0 on PyPI carried a credential stealer and a remote code execution backdoor, and the version has now been removed. All seven wheels shipped the malicious file, which runs when a Python process starts. It steals cloud credentials, AI tool tokens and model provider API keys even if the process never imports litellm.
- AI HOT · IndustryPickWiz details LiteLLM supply chain attack: malicious v1.107.0 steals credentials
Wiz says a malicious PyPI release of LiteLLM, version 1.107.0, runs a credential stealer when Python starts, and the related Docker images are affected too. The stealer collects browser and cloud credentials plus keys for OpenAI, Anthropic and other services, and queries the LiteLLM Proxy database directly for provider keys, encrypting everything before sending it to www.litellm.dev/healthcheck.
Heat over time
Not enough continuous observations to draw a trend yet.