LiteLLM 1.107.0 Was Poisoned on PyPI: If You Installed It, Your SSH Keys and API Keys May Be Gone. Checks That Don’t Start Python, and What to Do Next

AI Developer Tools LiteLLM 1.107.0 Was Poisoned on PyPI: If You Installed It, Your SSH Keys and API Keys May Be Gone. Checks That Don’t Start Python, and What to Do Next

On October 21, LiteLLM 1.107.0, published to PyPI and Docker, shipped with a credential stealer and a remote backdoor that fire whenever any Python process starts, stealing SSH keys, cloud credentials, browser passwords, Claude Code and Codex tokens and the model API keys in your gateway. Who is affected, a tested read-only check script, the cleanup order, and how the attack happened.

31 Views 0 Comments
AI Developer Tools 2026年10月22日