LiteLLM 1.107.0 on PyPI and Docker shipped an infostealer and backdoor
smakosh · reddit · 2026-10-22
Aikido disclosed that litellm==1.107.0 wheels on PyPI and Docker images (including latest/main-latest/main-stable) were trojanized with an infostealer and backdoor; 1.106.2 is clean.
- Malicious code runs on any Python start via cook.pth / sitecustomize.py, so pip show won't reveal it. Check for /tmp/.pconce72129118c59f5636c0bb (stealer ran) and /tmp/remotecodeloader.lock (backdoor ran).
- It reads LiteLLMCredentialsTable, exposing every provider key configured in the LiteLLM proxy — rotate all keys from a clean machine first, then rebuild.
- Mitigations: pin packages by hash (pip install --require-hashes) and images by digest.
- The poster works at competitor LLM Gateway and links a longer incident checklist.
More from coding & agent
- Classic 'too many tabs' meme applied to coding agents: send help — mrdrozdov · 2026-10-22
- YC F26 startup Latent reads model internals to catch hallucinations at 530x lower cost — ycombinator · 2026-10-22
- We need an L0.5 for continual learning: agent state stacks up in 4 layers — willcb · 2026-10-22
- DuckDB + Hugging Face Amsterdam workshop: build an AI feedback pipeline over 2.1M Amazon reviews — lhoestq · 2026-10-22
- Veracode report: AI now writes half of committed code but only 56% pass security checks — WeldPond · 2026-10-22
- Will Brown: Continual Learning in the Harness Is Like a Computer Without RAM — willcb · 2026-10-22