Today for AI
HOT RADAR
opensourceHEAT 12.7°

AI CURATED HOT STORY · 10/21/2026

Compromised LiteLLM 1.107.0 on PyPI Installs Credential Stealer and Backdoor

1 reports archived1 independent sourcesupdated 10/21/2026, 22:00:26
Synthesis & Latest Updates
1 Sources Cross-Validated

The LiteLLM 1.107.0 release on PyPI was compromised with a credential stealer and RCE backdoor affecting all platforms. The malicious code executes automatically upon any Python process start, even without importing litellm, exfiltrating SSH keys, cloud credentials, and LLM API tokens. PyPI has removed the release; users must downgrade immediately and rotate secrets.

LATEST/The LiteLLM 1.107.0 release on PyPI was compromised with a credential stealer and RCE backdoor affecting all platforms. The malicious code executes automatically upon any Python process start, even without importing litellm, exfiltrating SSH keys, cloud credentials, and LLM API tokens. PyPI has removed the release; users must downgrade immediately and rotate secrets.

HEAT TRENDHourly heat curve

2 fully observed hours
Fewer than 3 fully observed hours; trend not plotted yet.

TIMELINECoverage timeline

Total 1 reports · Latest first
  1. Hacker News AIT2·88 pts
    • LiteLLM 1.107.0 contains malicious .pth files and sitecustomize.py that execute theft logic whenever any Python process starts
    • Attackers injected code via PyPI release workflow or account takeover; GitHub source remains clean
    • Exfiltrated data includes SSH keys, cloud credentials, CI/CD secrets, browser passwords, and LLM provider keys from LiteLLM proxy databases