Today for AI
HOT RADAR
opensourceHEAT 0.0°

AI CURATED HOT STORY · 10/21/2026

Compromised LiteLLM 1.107.0 on PyPI Installs Credential Stealer and Backdoor

1 reports archived0 independent sourcesupdated 10/21/2026, 22:00:26
Synthesis & Latest Updates

The LiteLLM 1.107.0 release on PyPI was compromised with a credential stealer and RCE backdoor affecting all platforms. The malicious code executes automatically upon any Python process start, even without importing litellm, exfiltrating SSH keys, cloud credentials, and LLM API tokens. PyPI has removed the release; users must downgrade immediately and rotate secrets.

LATEST/The LiteLLM 1.107.0 release on PyPI was compromised with a credential stealer and RCE backdoor affecting all platforms. The malicious code executes automatically upon any Python process start, even without importing litellm, exfiltrating SSH keys, cloud credentials, and LLM API tokens. PyPI has removed the release; users must downgrade immediately and rotate secrets.

Hourly heat curve

168 fully observed hours
Now
0.0
Peak
8.319:00
24h change
–

The line compares only sources observed throughout; gap hours are interpolated to keep the trend continuous.

Coverage timeline

Total 1 reports · Latest first
  1. Hacker News AIT2·88 pts

    Compromised LiteLLM 1.107.0 on PyPI Installs Credential Stealer and Backdoor

    • LiteLLM 1.107.0 contains malicious .pth files and sitecustomize.py that execute theft logic whenever any Python process starts
    • Attackers injected code via PyPI release workflow or account takeover; GitHub source remains clean
    • Exfiltrated data includes SSH keys, cloud credentials, CI/CD secrets, browser passwords, and LLM provider keys from LiteLLM proxy databases