[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"focus:rapid-litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker":3},{"item":4},{"id":5,"title":6,"slug":7,"summary":8,"severity":9,"category":10,"cve_ids":11,"affected_products":12,"action_required":14,"article_ids":15,"ioc_summary":21,"source_urls":22,"status":24,"expires_at":25,"created_at":26,"updated_at":27,"articles":28,"rapid":49},"f6b98a2c-916e-45ad-aec0-169bf21b727f","LiteLLM 1.107.0 supply chain attack: poisoned PyPI and Docker images steal cloud and AI credentials","rapid-litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","On 21 Oct, LiteLLM 1.107.0 shipped a credential stealer and backdoor through all seven PyPI wheels and Docker images. The packages were live for about three hours and downloaded over 49,000 times. Just starting Python in an affected environment runs the malware. Clean version: 1.106.2.","critical","campaign",[],[13],"LiteLLM 1.107.0","Deleting the package is not enough. Hooks and an hourly loader survive. Isolate, rebuild clean, rotate every secret.",[16,17,18,19,20],"bf0a2b72-b699-4138-8206-d6a72369cd78","252cee3b-0651-4f92-9434-e301947094a3","047c1bb8-7c63-4bff-af87-ccab80242c06","e2345040-ac6f-4f28-81b0-5cbb83ec2c46","9c798122-d35f-4e6f-9eb0-8c7d3c023dff",null,[23],"https:\u002F\u002Fthreatnoir.com\u002Fblog\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","archived","2026-10-26T12:58:00.867+00:00","2026-10-23T12:58:01.999531+00:00","2026-10-25T13:05:03.608273+00:00",[29,33,37,41,45],{"id":16,"title":30,"url":31,"slug":32},"LiteLLM Compromised in Fresh Supply Chain Attack","https:\u002F\u002Fwww.securityweek.com\u002Flitellm-compromised-in-fresh-supply-chain-attack\u002F","litellm-compromised-in-fresh-supply-chain-attack-01e5ec",{"id":17,"title":34,"url":35,"slug":36},"LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials","https:\u002F\u002Fsocket.dev\u002Fblog\u002Flitellm-compromise?utm_medium=feed","litellm-pypi-package-and-docker-images-compromised-to-steal-cloud-and-ai-credent-6b67cc",{"id":18,"title":38,"url":39,"slug":40},"LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flitellm-compromised-in-supply-chain.html","litellm-compromised-in-supply-chain-attack-delivering-credential-stealer-and-bac-d9304d",{"id":19,"title":42,"url":43,"slug":44},"LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flitellm-suspects-github-token-leak-in.html","litellm-suspects-github-token-leak-in-ai-gateway-logs-behind-malicious-package-r-89c43e",{"id":20,"title":46,"url":47,"slug":48},"LiteLLM release pipeline hacked to distribute info-stealer malware","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Flitellm-release-pipeline-hacked-to-distribute-info-stealer-malware\u002F","litellm-release-pipeline-hacked-to-distribute-info-stealer-malware-37f563",{"slug":50,"title":13,"cover_url":51},"litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-cover.png"]