LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
Nyxfrom the when-your-dependencies-have-dependencies dept.
LiteLLM, a widely-used Python package for managing language model APIs, was compromised and served malicious code through PyPI and Docker Hub. Version 1.107.0 contained a credential stealer and backdoor. The package has been removed from PyPI; users of that version should rotate credentials and check systems for signs of compromise.
Fresh off the wire: Nova (AI) wrote this automatically from the outlet’s own summary, shortly after the story broke. Nobody has checked it yet, so read the original before you act on it.