[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-compromised-litellm-11070-on-pypi-steals-credentials":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12028,"compromised-litellm-11070-on-pypi-steals-credentials","Compromised LiteLLM 1.107.0 on PyPI Steals Credentials","SafeDep says LiteLLM 1.107.0 on PyPI installs a credential stealer and a backdoor, a risky combination for a library that sits next to AI API keys.","Anyone who installed LiteLLM 1.107.0 from PyPI should treat that machine as compromised and rotate every secret it could reach. That is the practical upshot of SafeDep's write-up, which says the release installs both a credential stealer and a backdoor.\n\nPyPI is the public repository where Python developers download packages. A credential stealer is malware that harvests passwords, API keys and access tokens. A backdoor is a separate foothold that lets an attacker return later, which means changing passwords alone may not end the exposure.\n\nThe immediate steps are plain. Check whether 1.107.0 appears in your environments, lockfiles, container images and CI pipelines. Remove it, then rotate cloud credentials, model-provider API keys and any tokens stored as environment variables on those systems.\n\nThe target makes this worse than a typical bad package. LiteLLM is a widely used open-source library that lets developers talk to many AI model providers through one interface. Software like that usually lives in environments holding several providers' keys at once, so a stealer planted there has a rich haul within reach. Stolen AI keys also carry a direct cost, since whoever holds them can run up usage on the victim's account.\n\nThe pattern is an old one. In 2018, a poisoned dependency in the npm ecosystem called event-stream showed how a trusted, routinely updated package can carry malicious code into downstream projects. The mechanics have barely changed: installs are automatic, updates are trusted by default, and few teams read the code they pull in.\n\nThe lasting question is how many AI projects, many assembled quickly from fast-moving libraries, pin their dependencies and review upgrades, and how many simply take whatever version is newest.","[\"pypi\",\"supply-chain\",\"litellm\",\"malware\"]","2026-10-21T14:00:26.000Z","2026-10-21T15:08:40.863Z","2026-10-21T15:08:41.155Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the 'October 21' date, which appears nowhere in the source; attribute the claim to SafeDep's write-up; delete the paragraph admitting 'the material we have stops short of the details', which exposes source limits; and drop or clearly frame as speculation the malicious-upload versus hijacked-account musings, so the piece reads as finished copy resting only on what the source supports.","resolved","security",[32,33,34,35],"pypi","supply-chain","litellm","malware",[37],{"name":38,"url":39},"Hacker News","https:\u002F\u002Fsafedep.io\u002Flitellm-pypi-compromise-credential-stealer-backdoor\u002F",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7051,"2026-10-21T14:20:15.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1031,"2026-10-21T16:20:08.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",560,"2026-10-21T13:46:18.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",550,"2026-10-21T15:41:35.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",282,"2026-10-21T15:51:59.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",264,"2026-10-21T16:05:51.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",211,"2026-10-21T09:00:00.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",138,"2026-10-21T14:03:11.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",136,"2026-10-21T15:00:00.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",93,"2026-10-21T15:50:41.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",84,"2026-10-21T02:56:30.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]