A poisoned LiteLLM release steals developers' credentials

Monthly downloads of LiteLLM on PyPI

92 million downloads a month

LiteLLM, an open-source tool for reaching AI models, has 92 million monthly downloads. Hackers pushed a poisoned version, 1.107.0, on Oct 21.

The malware steals cloud keys, browser data and developer secrets, and checks every hour for new code to run. The bad version was removed within three hours.

What to do

LiteLLM says the attacker used three engineers' stolen GitHub tokens, possibly leaked through its logs. It is the project's second such attack this year, after one in March.