Nördnytt! 🤓Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
- linsomniac - 17294 sekunder sedanJust going to remind you all that https://canarytokens.org/ exists.
- rsanheim - 8125 sekunder sedanThis is the second significant exploit against LiteLLM in what, a year or two ? Just last night I came across notes and a script from an older claude session to help audit all project dependencies and verify nothing used litellm.
Okay, checked, it was March of this year: https://futuresearch.ai/blog/litellm-pypi-supply-chain-attac.... What even is time anymore in the llm age?
- crossroadsguy - 17548 sekunder sedanAll the sandbox-exec and all the Lulu rules are not going to protect against something like this.
At one point permission pop-up fatigue sets in we start giving any permission as if it's normal. We also become desensitised to isntalling tools: brew, npm, it becomes second nature.
"Oh, those 367 tools installed by package X? Yeah yeah, must be normal, that's how all these work now".
"Brew shows 59 packages outdated?". "Must upgrade". "Yeah, done. Perfect".
And the advent of agents and harnesses. It's not a matter of whether, it's when! OSes need to do something about it. Help users have complete separate "program space" at ease with better, easier, and lighter VMs if nothing else. I know, I know - Unix and Linux solved all this even before Alexander III of Macedon started wearing his nappies. Of course.
- pkulak - 19626 sekunder sedanHow could this happen to a project with 55k commits in three years?
- threecheese - 11864 sekunder sedan"Attackers compromised 3 unique developer github credentials" is a little scary; this seems systemic - if three developers had their keys stolen, it implies the real problem is elsewhere.
They revoked all but one developers, which is probably the right approach, but I'd pin LiteLLM to "something before this version" and keep it there until further notice!
- madamelic - 21962 sekunder sedanI am not following how someone snuck the files into the release.
All I read was that it creates a directory from the build file but seemingly no description how new files or added dependencies slipped by. Was `cook.pth` a dependency that got automatically downloaded from PyPI on install and then the build system put it into dependencies?
--
Leaving this for others:
> BerriAI’s private release pipeline built these wheels from an attacker-modified git source. The attacker could have used a compromised maintainer or bot credential, a private branch or mirror, or the reference the pipeline builds from. A stolen PyPI token used from the attacker’s own machines fits the evidence less well.
Makes sense. It was that a maintainer or the private pipeline was attacked and the malicious dependency was injected there by squatting on the maintainer's local copy rather than the dependency being hijacked for everyone. Very clever.
- yujonglee - 14047 sekunder sedanOfficial Incident Post: https://docs.litellm.ai/blog/security-incident-oct-21-2026
- stbenjam - 26315 sekunder sedanIMHO defaults for uv, npm, etc should all have a cooldown for 24 - 48 hours by default, you should have to go out of your way to install something newer.
- saasisdead - 18397 sekunder sedanLast time they had this, I just vibe coded a version of lite llm and it actually works better
- tech_solver - 25043 sekunder sedanits litellm again. I wonder about maintainer trustworthiness
- baddash - 24370 sekunder sedanlitellm in the news again
- rcleveng - 27455 sekunder sedanSeriously again for litellm? I really with that things like Google ADK didn't add this to my deps.
- hmokiguess - 22964 sekunder sedanhttps://github.com/BerriAI/litellm/issues/47826#issuecomment...
> OSS Users > For the time being, please pin your version to 1.106.2 or any explicit version published prior to now.
> Enterprise Customers > There currently exists a private LiteLLM registry for enterprise customers, in which we are distributing an embargoed release that remediates a vulnerability whose disclosure date is scheduled for October 27. Our private registry is not affected. If you are an enterprise customer pulling from our private registry you are not affected.
- avereveard - 19692 sekunder sedanAgain this is the second time this year
- nairboon - 13058 sekunder sedanIsn't that at least the second time that LiteLLM got compromised?
- santiago-pl - 27105 sekunder sedanI wish all the best to LiteLLM team with handling it again. I can imagine how challenging are situations like this one.
However, if anyone is looking for 20x faster and less "targeted" LiteLLM alternative - I'm work on one in Go. That's why GoModel it's called. https://github.com/ENTERPILOT/GoModel/
- infecto - 24997 sekunder sedanAny package hosts that scan and include cooldowns by default that operate on a consumption model? The ones I have seen all charge a lot.
- merelydev - 17506 sekunder sedanA bad day for opensource, but I guess this is how we get stronger patch by patch.
- syntaxing - 24219 sekunder sedanI figured LLMs nowadays would be good enough to catch issues like this. Is it because it’s too costly to do it?
- callamdelaney - 25985 sekunder sedanWhy on earth do these people make it impossible to select the title of their article?
- 1-6 - 22458 sekunder sedanThis is the 2nd time. I'm glad I moved away from this platform.
- 1vuio0pswjnm7 - 21381 sekunder sedan1792590200 | LiteLLM Hijacked: Malicious 1.107.0 Wheels Steal Credentials | https://research.jfrog.com/post/litellm-hijacked-again/ | https://news.ycombinator.com/item?id=50180838 | 0 comments
1792590232 | Litellm 1.107.0 Compromised | https://github.com/BerriAI/litellm/issues/47826 | https://news.ycombinator.com/item?id=50180845 | 0 comments
- 0xbadc0de5 - 26944 sekunder sedanAgain! Yikes.
- jiwidi - 27015 sekunder sedanTwice? uiuiui
- rvz - 27617 sekunder sedanSo in just 1 week:
1. Google Cloud Outage [0]
2. eMudhra CA private key Leak [1]
3. PingCap TiDB 10.6 TB data Leak [2]
4. PHP2Shell uncovers critical CVEs (with AI) [3]
...and now we have Round 2 of a LiteLLM compromise after the first one in [4].
[0] https://news.ycombinator.com/item?id=50163961
[1] https://news.ycombinator.com/item?id=50166579
[2] https://news.ycombinator.com/item?id=50173716
- - 27108 sekunder sedan
- petesergeant - 26107 sekunder sedan> There currently exists a private LiteLLM registry for enterprise customers, in which we are distributing an embargoed release that remediates a vulnerability whose disclosure date is scheduled for October 27.
https://github.com/BerriAI/litellm/issues/47826
oh boy. Announcing that there's a private enterprise repo you should be paying for if you don't want a credential stealer in your build is quite the optic, and then announcing there's an undisclosed second vulnerability that's being distributed, just not to the poors...
- SomaticPirate - 22220 sekunder sedanSecond f**king time. Just torching their reputation at this point
- abletonlive - 13206 sekunder sedanWell it seems like it’s over for litellm. You’d have to be negligent to be using them at this point. If you’re managing this at your company good luck explaining why you should continue to use litellm after this
- bcvvvy - 23968 sekunder sedanFuck this week.
- smakosh - 16515 sekunder sedan[flagged]
- azyc - 24386 sekunder sedan[flagged]
- luis_valerio - 7262 sekunder sedan[flagged]
- latencyharbor - 21517 sekunder sedan[flagged]
- ibraryunus - 18778 sekunder sedan[flagged]
- News2Use - 26956 sekunder sedan[flagged]
- deployvet - 26732 sekunder sedan[flagged]
- rao-v - 19396 sekunder sedan[dead]
- Jeeetendra - 25969 sekunder sedan[flagged]
- chelseahermes - 30888 sekunder sedan[flagged]