FULL STORY

LiteLLM Supply Chain Poisoning and the Response

LiteLLM version 1.107.0 was hit by a credential-stealing supply chain attack affecting dspy and seven other packages. In the aftermath, free agent-focused cyber defense toolkits were released in response.

2026-10-21 ~ 2026-10-23 · 2 episodes · 19 posts

Episode 1 · LiteLLM 1.107.0 Poisoned in Supply-Chain Attack, Pulling in Eight Downstream Libraries (2026-10-21, 16 posts)

LiteLLM—a Python package for connecting to various AI model providers with over 92 million monthly downloads—has been hit by another supply chain attack. Version 1.107.0 was laced with malware, and both security teams and the maintainers urge users to immediately audit their environments and roll back versions. The incident was independently confirmed by security teams at Socket and JFrog, and is yet another poisoning attack on a critical dependency in AI infrastructure, with a broad blast radius and clear harm.

Confirmed

  • Socket's security team reported that litellm==1.107.0 on PyPI distributed credential-stealing malware via the PyPI wheel and a Docker image; JFrog's security team also found malicious code in the PyPI release of that version and advised avoiding it.
  • According to developer cedricchee, the version was planted with a credential stealer and a backdoor, both of which run on the host at every Python startup—even if the process never imports litellm.
  • The stealer targets sensitive credentials such as SSH keys; the official recommendation is to pin the version to 1.106.2.
  • Developer S1r1u5 separately warned of a typo-squatted lookalike package llitellm==1.107.0; environments that installed it have likely been compromised.

Why it matters

  • LiteLLM is a widely used LLM gateway library in the AI application ecosystem with over 92 million monthly downloads, so a poisoning incident has enormous reach.
  • Because the malicious code runs on every Python startup and does not depend on import, simply not using the library is not enough to stay safe—a full host audit is required.
  • cedricchee placed the incident alongside the contemporaneous OpenCode compromise, a breached certificate authority (CA), and an easily exploitable critical PHP vulnerability, arguing that the security situation for AI and broader critical infrastructure is deteriorating and deserves developers' heightened vigilance.

Episode 2 · Free Agent Cyber Defense bundle released after LiteLLM supply-chain attack (2026-10-23, 3 posts)

After the October 21 LiteLLM supply-chain poisoning and Railway credential leak, alvelda released the Agent Field Kit with six free cyber defense bundles and a dashboard, arguing that defending against LLM-enhanced attackers requires agent-based operations.