SHELFCRITTER AI Digest

TOOL

LiteLLM

tooltopic-noteinfrastructureagent-security

Overview

LiteLLM is a widely-used LLM proxy library that normalises API calls across many frontier model providers. It is a load-bearing dependency inside countless LLM app stacks and agent runtimes; a supply-chain compromise on LiteLLM reaches far beyond its direct user base. The 2026-10-22 digest covers a compromised 1.107.0 wheel on PyPI shipping a credential stealer and persistent backdoor — the first supply-chain hit on LiteLLM to saturate the HN front page.

Timeline

  • 2026-10-22-AI-Digest — A compromised release of the LiteLLM proxy library — version 1.107.0, now pulled by PyPI — reportedly shipped injected files absent from the matching git tag, built from a lookalike GitHub repository whose name differed by a single hyphen. The reported payload runs a credential stealer at Python interpreter startup, targeting cloud, SSH, CI/CD, and AI-tool credentials, and installs an hourly remote-code loader. Clean versions reported by SafeDep: 1.106.2, 1.107.0rc1, 1.107.0rc2. What’s defensibly reportable: a front-page HN story at 467 pts / 158 cmts and The Hacker News coverage both place a supply-chain incident on LiteLLM 1.107.0 on 2026-10-21; the SafeDep research write-up is the primary technical source. Teams pinning minor-version floats on litellm should treat the LLM API keys in affected environments as compromised and consult SafeDep’s primary write-up and the LiteLLM GitHub security advisory for the authoritative version list before remediation. Log against MOC - Agent Security and MOC - Developer Tools.

Key Developments

  1. Compromised 1.107.0 Wheel on PyPI Ships a Credential Stealer and Persistent Backdoor (October 21, 2026): The compromised wheel contained injected files absent from the matching git tag, built from a lookalike GitHub repository whose name differed by a single hyphen. The payload runs a credential stealer at Python interpreter startup (cloud, SSH, CI/CD, and AI-tool credentials) and installs an hourly remote-code loader. Clean versions per SafeDep: 1.106.2, 1.107.0rc1, 1.107.0rc2. Load-bearing framing: LiteLLM is a load-bearing dependency for countless LLM app stacks — a supply-chain hit here is a direct threat to anyone pinning minor-version floats on litellm.

See also: MOC - Agent Security, MOC - Developer Tools.