LiteLLM 1.107.0 on PyPI carried a credential stealer and a backdoor
TL;DR
- On 21 October LiteLLM's release pipeline pushed version 1.107.0 to PyPI and Docker with a credential stealer and a backdoor inside; PyPI removed it by 13:23 UTC, Docker Hub by 14:20 UTC.
- SafeDep's analysis says the planted files run whenever any Python process starts, steal SSH keys, cloud and CI secrets, AI tool tokens and a LiteLLM proxy's provider keys, and fetch code from a server every hour.
- LiteLLM's 21 October account blames stolen GitHub CLI credentials of three developers and a look-alike repository, and on 23 October it said some of those assumptions were later found inaccurate or incomplete.
Read the full story
Sign in with your email to read AI News. It’s free.