LiteLLM 1.107.0 supply-chain compromise: check your Python dependencies

In a supply-chain attack, the package you install is no longer the package its authors wrote, and it runs with the same access as your own code. That is why a compromised release of a popular library deserves an immediate check.

LiteLLM 1.107.0

A supply-chain compromise of LiteLLM 1.107.0 on PyPI is worth checking against your Python dependencies. This story does not describe what the malicious version does: for that, read the maintainers' and PyPI's own notices. Until you know, assume that any secret available to a process that imported the package could have been exposed.

Check your projects

pip show litellm
pip freeze | grep -i litellm
# in a container image
docker run --rm my-app pip show litellm

Also search your lock files and requirements for the version, and check build caches and CI images: requirements.txt, poetry.lock, uv.lock and Pipfile.lock. A project can pull the package in indirectly, so look at the full dependency list, not only what you wrote.

If you find 1.107.0

• Remove or upgrade it to a version the maintainers say is safe, and rebuild every image that contained it.
• Rotate every secret the environment could reach: API keys, cloud credentials, tokens and passwords.
• Review logs from the time it was installed for unexpected network connections and new credentials.

Make the next one less likely

• Pin versions in a lock file, and install from it in CI and production.
• Use hashes. pip install --require-hashes -r requirements.txt refuses a package whose contents changed.
• Keep secrets out of build and test environments where you can.
• Update on purpose, after a short wait, rather than taking a release the minute it appears.

This is not the first time a trusted library has turned hostile: a poisoned Java library was pulled after a deserialisation backdoor was found, and the Silent Ledger lure reached crypto exchanges through the supply chain.

What we looked at and did not find

• No confirmed breaches at AWS, Azure, GitHub, Okta or Auth0 in our check.
• A Google Cloud europe-west2 availability incident ran on 20 and 21 October. It was an outage, not a security incident.
• The Android patch level 2026-10-01 has no flaws reported as exploited.

Absence of a report is not proof of safety, so keep watching the providers' status and security pages.

The bottom line

Check every Python project and image for LiteLLM 1.107.0, rebuild and rotate secrets if you find it, and pin and verify your dependencies. AI tooling is now part of the attack surface, as attackers testing LLM agents for reconnaissance shows.