LiteLLM v1.107 compromised
"Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and Docker registries."
The article mentions a previous attack this year hitting over 400k CI pipelines on 2500 organizations.
https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548
ChipTuner
npub1qd…3fqm7
2026-10-21 22:02:00 UTC
Author Public Key
npub1qdjn8j4gwgmkj3k5un775nq6q3q7mguv5tvajstmkdsqdja2havq03fqm7Seen on
wss://nos.lolPublished at
2026-10-21 22:02:00 UTCEvent JSON
{
"id": "bacb6ec74713760e3015fe222bf8f37a9df6435722f3015014b7b64d8cb60e3f",
"pubkey": "036533caa872376946d4e4fdea4c1a0441eda38ca2d9d9417bb36006cbaabf58",
"created_at": 1792620120,
"kind": 1,
"tags": [],
"content": "LiteLLM v1.107 compromised \n\n\"Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1.107.0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and Docker registries.\"\n\nThe article mentions a previous attack this year hitting over 400k CI pipelines on 2500 organizations. \n\nhttps://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548",
"sig": "1246def71c25cbf953b7f2a7dce1ceae8c76371dddabcb8ed995a786341b43e1c4f36ac0d4d089d4ce0b00121b1ca92233366a074a0c462808f4d420f719cbcc"
}