LiteLLM 1.107.0 Hit by Supply Chain Attack on PyPI

LiteLLM suffered another supply chain compromise: a typo-squatted package and the PyPI release of 1.107.0 contained malicious code, with JFrog urging users to avoid the version and audit affected environments.

2026-10-21 ~ 2026-10-21 · 2 related posts

• LiteLLM compromised again: installing version 1.107.0 likely means your environment is breached — banteg · 2026-10-21
• JFrog finds malicious code in LiteLLM 1.107.0 PyPI release — DanielLockyer · 2026-10-21