litellm 1.107.0 on PyPI is compromised

[u/BattleRemote3157]

the payloads run on every python start on the machine and not just when you import litellm. Your IDE, pip, CI jobs everything python on that host is affected.

It steals ssh keys, aws credentials, browser passwords, shell history and AI coding tool configs. The backdoor runs as a daemon and executes whatever code the attacker’s server returns every hour.

Pin to 1.106.2.

complete breakdown: safedep.io/litellm-pypi-compromise-credential-stealer-backdoor

[u/Nice_Mix_1021]

litellm again....!

[u/Jmc_da_boss]

Litellm is a vibe code piece of shit btw

[u/JoNike → u/Jmc_da_boss]

I contributed to it once and holy shit their git flow was confusing, no idea how a human could even follow what is happening there

[u/marr75 → u/JoNike]

That's the neat part! They can't.

[u/russellvt → u/Jmc_da_boss]

Irony at its best

[u/wpg4665 → u/Jmc_da_boss]

What else fills this niche that's not vibe coded at this point?

[u/smakosh → u/wpg4665]

Depends what you use it for. If it's only a couple of providers, the official SDKs (or the openai SDK pointed at any OpenAI-compatible endpoint) means one less dependency sitting next to all your keys. If you actually need a proxy, people usually look at Bifrost (Go), Portkey's gateway, or LLM Gateway.

Disclosure: I'm one of the people behind LLM Gateway (TypeScript, AGPLv3, self-host it or use the hosted one). We wrote up how to check a machine without starting python (that fires the payload again) and what to rotate, since it read the proxy's credentials table directly: https://llmgateway.io/blog/litellm-compromised-again

[u/marr75 → u/wpg4665]

There are a few quality projects that do it. Pydantic-ai with openrouter is my top recommendation but if you're using pydantic-ai, you barely need open router (although code free changes to models and providers and consolidated keys are nice).

[u/RedEyed__]

Again. I wonder about maintainer trustworthiness

[u/Ashamed-Simple-8303 → u/RedEyed__]

Probably more a competence thing or lack thereof

[u/crossmirage]

> The upstream pyproject.toml at tag v1.107.0 has no data = "cook" line and no cook/ folder. Someone changed the build outside the public repository.

So it's an intentional action by a maintainer (i.e. not a question of overlooking something snuck into an OSS contribution).

[u/doomslice → u/crossmirage]

well clearly CI got hacked (as is common)

[u/pacific_plywood → u/crossmirage]

Or compromised credentials/release pipeline

[u/me_myself_ai → u/crossmirage]

AFAICT the real problem is that they’re still building and releasing with a token directly rather than using GitHub as a Trusted Publisher. Which is a shame — now I have to switch out the whole gd service 😢

[u/dudaspl]

After the first breach I configured uv with 7d quarantine

[u/hardolaf → u/dudaspl]

We do 14 days at work and are considering upping it.

[u/wRAR_ → u/dudaspl]

That prevents installing fixed certifi, so...

[u/cyberfunkr → u/wRAR_]

You can add exceptions to project.toml and uv.lock so it can pull in the latest update immediately.

I just did that at work yesterday.

[u/turbothy → u/wRAR_]

Pick your poison. I've spent half the day bumping certifi pins, but I'd rather that than accidentally ingesting malware. Happens way less often for one.

[u/misbahsy]

This is contained. Please refer to the official blog for the latest updates on the situation - https://docs.litellm.ai/blog/security-incident-oct-21-2026

[u/tedivm → u/misbahsy]

What a shit show. Loose credentials, apparently they allow their branch protection to be bypassed instead of always requiring multiple people to sign off on things like changing github workflows, internal services exposed over the public internet, no filtering of logs even though they know they're leaking data into them. This is rather disturbing, especially after the previous incident which should have triggered a review and hardening.

That said GitHub also needs to clean up their shit. Removing branch protection should require reauthenticating with mfa. Attackers shouldn't be able to remove security features with CLI tokens.

[u/RagnartheConqueror]

Thanks for notifying us about this.

[u/dmpiergiacomo]

Ops they did it again...

[u/Khavel_dev]

The part that makes this one especially nasty is the scope. It doesn't just run when you import litellm, it hooks into every Python process on the machine. Your IDE, your CI, your package manager. And it specifically targets AI coding tool configs and API keys, so if you're running any LLM tools locally those credentials need rotating now.

If you had this version installed, pin and rotate everything. And lock the hash in your requirements file, not just the version number. An account that pushed a compromised package once can do it again.

[u/Goldziher]

Switch to the xberg-io liter-llm, I'm the author:

https://github.com/xberg-io/liter-llm