Backdoored litellm 1.107.0 Pulled In Silently by dspy and Seven Other Libraries

Future_AGI · reddit · 2026-10-22

A post-mortem of the Oct 21 litellm 1.107.0 supply-chain compromise: between 11:39 and 13:23 UTC, a pip install dspy in a clean Python 3.10+ environment resolved to the backdoored version, even though the user never typed litellm. dspy 3.4.1 lists litellm>=1.65.8 as a regular dependency with no upper bound.

Exposure

Eight libraries require litellm with a range allowing 1.107.0; six more pull it in via extras like crewai[litellm]
aider and openhands pin exact versions; opik caps below 1.106; browser-use does not depend on litellm
mini-swe-agent excludes 1.82.7/1.82.8 from the March incident, but 1.107.0 still matched
On Docker Hub, the LiteLLM proxy's latest/main-latest/main-stable tags pointed at the bad build from 11:46 to 14:20 UTC, so Watchtower-style auto-updates count too

Payload: the wheel drops cook.pth, cook.py and sitecustomize.py into site-packages, executing on every interpreter start including pip. Aikido's analysis says it harvested SSH keys, cloud credentials, env vars, and tokens for Claude Code, Cursor, Copilot and Gemini CLI.

Checking: avoid pip show/uv tree (they can start the env's Python and fire the payload); use find for cook.pth, grep lockfiles, ls site-packages. LiteLLM's incident report says to assume data left any host where 1.107.0 ran with internet access, then rebuild and rotate every reachable credential.

Prevention: both compromises this year lived on PyPI for about three hours or less; a one-week cooldown skips them — exclude-newer = "7 days" in uv, --uploaded-prior-to P7D in pip.

Original post →

Backdoored litellm 1.107.0 Pulled In Silently by dspy and Seven Other Libraries

More from coding & agent