LiteLLM Package Compromised in Supply Chain Attack

The Hacker News reports that LiteLLM, a popular Python package used to route requests to large language models, was compromised in a software supply chain attack. Researchers at SafeDep, Socket, StepSecurity and Upwind found that a malicious build, version 1.107.0, was published as both PyPI wheels and Docker images. The malicious code ran at Python startup through a path file named "cook.pth," installing a credential stealer and a backdoor capable of fetching and executing additional code. LiteLLM said the attacker used stolen GitHub CLI OAuth tokens from three of its engineers; PyPI has since quarantined the package and the malicious Docker images were removed.

Why it matters: LiteLLM sits at the center of many enterprise AI stacks as the gateway between applications and LLM providers, so a compromised build can expose API keys and credentials across an entire AI pipeline. Anyone who installed version 1.107.0 should rotate exposed credentials and pin to version 1.106.2 by digest, and it is a reminder to vet AI infrastructure dependencies and CI credentials as carefully as any other production software supply chain.