LiteLLM PyPI package version 1.107.0 compromised with credential stealer and backdoor
Tool · Reddit · stat: v1.107.0 LiteLLM's PyPI package release version 1.107.0 was compromised to distribute a credential stealer and persistent backdoor. Security research firm SafeDep confirmed the…
Tool · Reddit · stat: v1.107.0
LiteLLM's PyPI package release version 1.107.0 was compromised to distribute a credential stealer and persistent backdoor. Security research firm SafeDep confirmed the malicious release on Python's official package index, targeting developer environment tokens and secrets. Teams using the open-source LLM proxy library must audit dependencies for version 1.107.0.
Open-source AI glue packages remain prime supply-chain attack targets Lock your AI middleware dependency versions immediately and pin hashes to prevent automated CI build compromises.
Every claim ties to a primary source. See our methodology.