The popular open-source AI gateway says attackers took over its release pipeline on 21 October and pushed a poisoned version 1.107.0 to PyPI and Docker; users should pin to 1.106.2 and rotate secrets.
LiteLLM, an open-source tool that lets developers route requests to many AI model providers through one interface, says its release pipeline was compromised early on 21 October and used to publish a malicious version 1.107.0. The company says the package was live on PyPI from 11:39 to 13:23 UTC (7:39 to 9:23 AM ET), and that its Docker images tagged v1.107.0, latest, main-latest and main-stable were compromised for up to about two and a half hours; the malware steals credentials and loads remote-code tools. The compromise was first reported publicly in an issue on LiteLLM’s GitHub by an outside researcher, whom the company credits with helping detect it. LiteLLM says the official source code was not altered, the malicious artifacts were built from an “attacker-controlled repository”, and customers on its private enterprise registry were not affected. Anyone who installed the affected version or ran those images in that window should treat the machine as compromised, remove the malicious files before starting Python again, reinstall a pinned 1.106.2 and rotate every key and password the host could reach. Security firms Wiz and JFrog published their own analyses.
Sources: LiteLLM · GitHub issue #47826 · Wiz · JFrog Security Research