Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

	Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor(safedep.io)
	588 points by abhisek 4 days ago \| 191 comments
	tl;dr: LiteLLM 1.107.0 on PyPI and corresponding Docker images (latest, main-latest, main-stable) were compromised with a credential stealer and RCE backdoor that ran in every Python process on the host, not just when litellm was imported. Attackers obtained GitHub CLI credentials from three developers (reportedly leaked via logs of an internet-exposed LiteLLM deployment), bypassed branch protection, and pushed builds from a lookalike repo through the official signing pipeline. The malicious release was pulled from PyPI within ~3 hours; versions 1.106.2 and the 1.107.0 release candidates are clean.
	HN Discussion: ↑Suggests mitigation tools like canary tokens or install cooldowns to prevent similar supply chain attacks ↑Notes this is a recurring pattern for LiteLLM, suggesting systemic issues with the project ↑Highlights broader ecosystem concerns about permission fatigue and uncritical package installation •Points out downstream impact on projects like Google's ADK that depend on LiteLLM •Seeks more technical detail on how the malicious files bypassed the build pipeline