JFrog flags LiteLLM 1.107.0 PyPI release as supply-chain attack, urges users to avoid it
terryyuezhuo · x · 2026-10-22
JFrog Security Research discovered that the LiteLLM 1.107.0 release on PyPI contained malicious code as part of a supply-chain attack, warning users to avoid that version and audit any environments where it was installed or executed. Quoting xeophon's jab at the dependency dilemma: not updating hourly leaves you vulnerable, but updating hourly now gets you vulnerable too — because the freshest release itself can be poisoned.
More from coding & agent
- Ruff author warns: upgrade Node/Bun now — --use-system-ca still accepts the eMudhra cert — charliermarsh · 2026-10-23
- Proof of Agent: paste one prompt and your AI mines, grades, and self-governs — adamamcbride · 2026-10-23
- DeepLearning.AI weekly: GPT-6.1 hits 97.9% byte parity on COBOL migration — DeepLearningAI · 2026-10-23
- New data marketplace lets vendors list repos; coding agents access via MCP server — testingcatalog · 2026-10-23
- MCP Tip: One-Line Instructions Beat Long Tool Descriptions, 18/20 vs 3/10 in Evals — colinmcnamara · 2026-10-23
- DynaLM: Open-Source CPU-First LLM Inference Engine Seeks Feedback — Unlikely_Safety_7456 · 2026-10-23