Anyone who installed LiteLLM 1.107.0 from PyPI should treat that machine as compromised and rotate every secret it could reach. That is the practical upshot of SafeDep's write-up, which says the release installs both a credential stealer and a backdoor.
PyPI is the public repository where Python developers download packages. A credential stealer is malware that harvests passwords, API keys and access tokens. A backdoor is a separate foothold that lets an attacker return later, which means changing passwords alone may not end the exposure.
The immediate steps are plain. Check whether 1.107.0 appears in your environments, lockfiles, container images and CI pipelines. Remove it, then rotate cloud credentials, model-provider API keys and any tokens stored as environment variables on those systems.
The target makes this worse than a typical bad package. LiteLLM is a widely used open-source library that lets developers talk to many AI model providers through one interface. Software like that usually lives in environments holding several providers' keys at once, so a stealer planted there has a rich haul within reach. Stolen AI keys also carry a direct cost, since whoever holds them can run up usage on the victim's account.
The pattern is an old one. In 2018, a poisoned dependency in the npm ecosystem called event-stream showed how a trusted, routinely updated package can carry malicious code into downstream projects. The mechanics have barely changed: installs are automatic, updates are trusted by default, and few teams read the code they pull in.
The lasting question is how many AI projects, many assembled quickly from fast-moving libraries, pin their dependencies and review upgrades, and how many simply take whatever version is newest.