> ## Content Index
> Fetch the complete content index at: https://blog.cleverly.ca/llms.txt
> Use this file to discover other available public pages before exploring further.

# LiteLLM 1.107.0: A Supply-Chain Compromise Worth Checking For
- URL: https://blog.cleverly.ca/litellm-1-107-0-a-supply-chain-compromise-worth-checking-for/
- Published: 2026-10-24T17:07:22.000Z
- Updated: 2026-10-24T17:13:18.000Z
- Description: A compromised release of the AI tool LiteLLM shipped a credential stealer and a backdoor. If your team installed version 1.107.0 on October 21, treat the machine as compromised — here's what to check.
- Author: Scott Vincent

If your business uses AI tools in its software — or your developers do — this one is worth five minutes of attention. A popular open-source AI tool called LiteLLM shipped a compromised release, and the damage it does goes far beyond the tool itself.

## What happened

On October 21, LiteLLM version 1.107.0 went out on PyPI and Docker Hub carrying two malicious additions: a credential stealer and a backdoor. The release was pulled within a few hours, but the exposure window — roughly two hours — was more than enough.

The nasty detail: the stealer ran every time *any* Python process started on the machine, even processes that never touched LiteLLM. It collected exactly the credentials a business holds most dear — SSH keys, cloud credentials, CI/CD secrets, AI provider tokens, browser data, and LiteLLM proxy keys — and sent them to a lookalike domain. The backdoor, meanwhile, checked in hourly for new instructions.

## What to do

- **If anything installed LiteLLM 1.107.0 on October 21,** treat that machine as compromised. Uninstalling the package is not enough — rotate every credential that machine could have touched, from a clean environment.
- **Check for the fingerprints:** `cook.pth` and `sitecustomize.py` are the files to hunt for.
- **Safe versions:** 1.106.2, or the 1.107.0 release candidates. Anything else from that day should be treated as suspect.
- **The bigger lesson:** this got in through stolen GitHub credentials that bypassed the project's branch protections. Supply-chain attacks don't announce themselves — they ride in with the software you already trust.

## Why it matters for SMBs

You don't need to run LiteLLM to take the lesson. Any business that relies on third-party software — which is every business — is exposed to the same pattern: a trusted update turns hostile, and the compromise spreads to everything the machine can reach. Knowing what your team installed, and when, is the difference between a quick cleanup and a quiet breach discovered months later.

---

*If you're not sure what software your business is running — or who would notice a compromise like this — that's the kind of visibility a managed IT partner provides.* [*Get in touch*](https://cleverly.ca/?ref=blog.cleverly.ca) *— Cleverly Named Solutions provides managed IT and cybersecurity for SMBs across Niagara, Welland, and Saint John.*