LiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed wheel files.

This is written for those who use AI or LLM libraries in Python and haven't decided where to stop or how to detect when a ...

Attackers compromised LiteLLM's release pipeline to ship a credential stealer and backdoor, then tested stolen AWS ...

When building a new Python service or spinning up a microservice architecture, the instinct is often to fire up your terminal ...

Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals ...

A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker with malware that steals cloud logins, developer secrets ...

Recent cybersecurity incidents have raised concerns among companies and government agencies regarding digital certificates ...

If you reinstalled LiteLLM on the night of October 21st without pinning the version, please check your environment first. The ...

Tencent's Hy-Memory-30B-A3B is a free open-source mixture-of-experts model claiming Claude Opus 5 parity on AI agent memory ...

Attackers used stolen GitHub credentials to push a backdoored version of the popular AI gateway, exposing cloud, Kubernetes, ...

PyPI quarantined the trojanized version of the popular open source AI gateway within hours, and the Docker image (litellm/litellm:1.107.0) was removed from both Docker Hub and GHCR soon after - but ...

Security researchers have uncovered another LiteLLM package hijack, warning that malicious code in version 1.107.0 can steal ...