LiteLLM 1.107.0: A Supply-Chain Compromise Worth Checking For
A compromised release of the AI tool LiteLLM shipped a credential stealer and a backdoor. If your team installed version 1.107.0 on October 21, treat the machine as compromised — here's what to check.
If your business uses AI tools in its software — or your developers do — this one is worth five minutes of attention. A popular open-source AI tool called LiteLLM shipped a compromised release, and the damage it does goes far beyond the tool itself.
What happened
On October 21, LiteLLM version 1.107.0 went out on PyPI and Docker Hub carrying two malicious additions: a credential stealer and a backdoor. The release was pulled within a few hours, but the exposure window — roughly two hours — was more than enough.
The nasty detail: the stealer ran every time any Python process started on the machine, even processes that never touched LiteLLM. It collected exactly the credentials a business holds most dear — SSH keys, cloud credentials, CI/CD secrets, AI provider tokens, browser data, and LiteLLM proxy keys — and sent them to a lookalike domain. The backdoor, meanwhile, checked in hourly for new instructions.
What to do
- If anything installed LiteLLM 1.107.0 on October 21, treat that machine as compromised. Uninstalling the package is not enough — rotate every credential that machine could have touched, from a clean environment.
- Check for the fingerprints:
cook.pthandsitecustomize.pyare the files to hunt for. - Safe versions: 1.106.2, or the 1.107.0 release candidates. Anything else from that day should be treated as suspect.
- The bigger lesson: this got in through stolen GitHub credentials that bypassed the project's branch protections. Supply-chain attacks don't announce themselves — they ride in with the software you already trust.
Why it matters for SMBs
You don't need to run LiteLLM to take the lesson. Any business that relies on third-party software — which is every business — is exposed to the same pattern: a trusted update turns hostile, and the compromise spreads to everything the machine can reach. Knowing what your team installed, and when, is the difference between a quick cleanup and a quiet breach discovered months later.
If you're not sure what software your business is running — or who would notice a compromise like this — that's the kind of visibility a managed IT partner provides. Get in touch — Cleverly Named Solutions provides managed IT and cybersecurity for SMBs across Niagara, Welland, and Saint John.
