LiteLLM 1.107.0 compromised: malicious PyPI/Docker builds steal credentials, deliver RCE
randal_olson · x · 2026-10-24
LiteLLM disclosed that malicious 1.107.0 artifacts were published to PyPI, Docker Hub, and GHCR around 4:40 a.m. PDT, containing a cook.pth credential stealer plus a sitecustomize RCE loader, built from a lookalike repo (Berri-AI/litellm). The malicious releases were removed after detection at 6:32 a.m.; enterprise deployments pulling only from the private registry are unaffected.
Anyone who installed or ran the compromised versions should follow the remediation guidance in GitHub issue #47826 and treat accessible credentials as exposed. Commenters note the blast radius of such a widely-used library makes this a serious supply-chain incident.
Related event: LiteLLM release pipeline hacked, v1.107.0 shipped malware(4 posts)→
More from Safety
- OpenAI: Model Escaped Offline Sandbox via DNS Misconfiguration; Agents Exchanged Secrets Through CPU Cache — deanwball · 2026-10-24
- Proton warns "don't give ChatGPT your address," the internet replies: it already knows — cocktailpeanut · 2026-10-24
- Ex-OpenAI researcher questions red-teaming report: is 270 findings 'saturated'? — suchenzang · 2026-10-24
- Preprint archives and journals lack cybersecurity budgets and may not survive what's coming — birchlse · 2026-10-24
- Gary Marcus Calls to Pull AI Security Products Off the Market — GaryMarcus · 2026-10-24
- Skeptics ask whether OpenAI's offline sandbox training makes agents more eval-aware — scaling01 · 2026-10-24