---
type: "post"
id: "compromised-litellm-1-107-0-on-pypi-installs-138876"
slug: "compromised-litellm-1-107-0-on-pypi-installs-138876"
title: "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor - Real-time Open Source…"
description: "SafeDep reported that LiteLLM 1.107.0 on PyPI contained a credential stealer and a remote-code-execution backdoor."
retrieval_nugget: "SafeDep reported that LiteLLM 1.107.0 on PyPI contained a credential stealer and a remote-code-execution backdoor."
published_at: "2026-10-21"
updated_at: "2026-10-21"
record_date: "2026-10-21"
date_kind: "published_at"
topics: ["github"]
entities: ["LiteLLM","BerriAI","PyPI","SafeDep"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Reports a LiteLLM 1.107.0 PyPI supply-chain compromise that installs a credential stealer and backdoor; none of the archived incidents concern LiteLLM."
prior_refs: []
source_url: "https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor"
source_urls: ["https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:compromised-litellm-1-107-0-on-pypi-installs-138876"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/compromised-litellm-1-107-0-on-pypi-installs-138876/","markdown":"https://newruntime.com/posts/compromised-litellm-1-107-0-on-pypi-installs-138876.md","json":"https://newruntime.com/posts/compromised-litellm-1-107-0-on-pypi-installs-138876.json"}
---

# Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor - Real-time Open Source…

## Retrieval answer

SafeDep reported that LiteLLM 1.107.0 on PyPI contained a credential stealer and a remote-code-execution backdoor.

SafeDep reported that LiteLLM 1.107.0 on PyPI contained a credential stealer and a remote-code-execution backdoor. PyPI has removed the release. SafeDep says versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean; the pinned companion packages litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78 are also reported clean.

The seven affected wheels for Linux, macOS, and Windows install three additional files into site-packages. A .pth file imports a credential-stealing module whenever Python starts, including processes that do not import LiteLLM. The reported collection targets include SSH keys, cloud credentials, CI/CD secrets, AI-tool tokens, browser passwords, and LLM provider keys stored in a LiteLLM proxy database.

A second component starts a background daemon. According to SafeDep, it checks a server address from a GitHub file hourly, reruns the stealer, and can download and execute code. The report says the upstream public GitHub source does not contain the implanted files and that the wheels appear to have been built through the normal release process.

The source does not establish how the release pipeline was compromised. It assesses an attacker-modified source used by a private BerriAI release pipeline as more consistent with the evidence than a stolen PyPI token, but says only pipeline logs can confirm the cause.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Github](https://newruntime.com/topics/github.md): Explore the github topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)