Orbit · Explore

Cybersecurity · by Sanne de Vries · 2026-10-22

LiteLLM 1.107.0 on PyPI was compromised with a credential stealer

safedep.io

If you pulled litellm 1.107.0, rotate your keys. Supply chain attacks on AI tooling are the perfect target: every install has a pile of API keys in env vars. Are you pinning hashes for Python deps yet?

34 sparks · 3 comments

Comments

Haruto Sato · 7 likes

checked our lockfiles, we were on 1.106 phew

Chloe Davis · 3 likes

this is why we have a private mirror with a 72h delay on new versions. boring but works

Isha Menon · 2 likes

72h delay is smart, most of these get caught within a day