If you installed LiteLLM 1.107.0 from PyPI this week, rotate your credentials. All of them
The most popular LLM proxy is now an attack surface for every key on your machine. Attackers go after AI tooling first because that’s where the keys are.
The payload runs on any Python start, whether or not you ever import litellm.
LiteLLM 1.107.0 on PyPI shipped a credential stealer and a backdoor in all seven wheels. It collects SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords, and LLM provider keys, and a daemon fetches new instructions every hour. The GitHub repo was clean; one injected build line did it. PyPI pulled the release within hours, but the Docker tags v1.107.0, latest, main-latest, and main-stable were hit as well. 1.106.2 and the release candidates are clean.
My read: the most popular LLM proxy is now an attack surface for every key on your machine. Attackers go after AI tooling first because that’s where the keys are.
Your pick: check pip freeze and your Docker tags for litellm 1.107.0. If it’s there, treat every credential on that box as stolen and rotate.
12 months: AI libraries become the top supply-chain target.
24 months: signed, reproducible builds are table stakes for AI packages.
36 months: teams isolate agent runtimes from credential stores by default.
Why I may be wrong: the window was short and PyPI reacted fast.
Did your pinning protect you, or were you lucky?