LiteLLM 1.107.0 Compromised on PyPI: Credential Stealer Hidden in Library Downloaded 23 Million Times a Week

LiteLLM 1.107.0 Compromised on PyPI: Credential Stealer Hidden in Library Downloaded 23 Million Times a Week

LiteLLM, the popular Python library used to route requests across AI models with about 23 million weekly downloads, was hit by a supply-chain attack on October 21 that shipped a credential stealer and a backdoor inside version 1.107.0. Security firms SafeDep, Socket, StepSecurity and Upwind all flagged the compromise. PyPI quarantined the malicious release within two hours, and the tainted Docker images were removed.

The attack was unusually dangerous. A file called cook.pth made Python run the malicious "cook" module at interpreter startup — so the stealer activated in every Python process on a host, even ones that never imported LiteLLM. It harvested cloud credentials, SSH keys, CI/CD secrets, AI developer-tool tokens, browser passwords and the LLM provider keys stored in a LiteLLM proxy database, encrypting and exfiltrating them to a lookalike domain. A second payload, sitecustomize.py, ran a background daemon that checked a GitHub dead drop every hour and downloaded and executed attacker code.

LiteLLM's security chief, Oliver Jensen, said the attackers used stolen GitHub CLI OAuth tokens from three engineers' accounts to trigger and approve an official-looking release build from a malicious fork named "Berri-AI/litellm" — one hyphen different from the real project. The incident is LiteLLM's second supply-chain compromise of 2026 after a March attack. Users who installed 1.107.0 are advised to revoke exposed credentials from a clean environment and pin version 1.106.2.

Source: read more

Comments

Post a Comment

Popular posts from this blog

Fairbairn's Walk-Off Field Goal Seals Wembley Thriller as Texans Edge Jaguars 34-31

Ka'imi Fairbairn drilled a 49-yard field goal as time expired to give the Houston Texans a dramatic 34-31 victory over the Jacksonville Jaguars at Wembley Stadium on Sunday. It was a fitting end to a wild afternoon in London that began with the referee being carted off injured in the opening seconds and featured Corgi races entertaining the crowd at half-time. Quarterback C.J. Stroud threw for 312 yards and three touchdowns for Houston, while Jacksonville's Trevor Lawrence answered with 306 yards and four scores of his own. The game's standout was two-way star Travis Hunter, who caught a touchdown and intercepted Stroud in the end zone — the first player to score a touchdown and record an interception in the same game since 2002. Jacksonville's Cam Little tied the game at 31-31 with a booming 60-yard field goal with under two minutes left, but Stroud calmly drove Houston into range for Fairbairn's winner. The victory moved the Texans to 2-4, their second straight wi...
Read more

Anthropic IPO: Public S-1 Filing Expected Today Ahead of $2 Trillion Listing

Image
Anthropic, the AI company behind Claude, is set to publicly file its S-1 IPO registration as soon as Friday, October 23, three people familiar with the plans told Yahoo Finance. The filing would start the clock on one of the biggest tech listings ever: a Nasdaq debut targeted for mid-November, with some investors weighing a valuation near $1.5–2 trillion. A draft of the prospectus, reviewed earlier this week by the Wall Street Journal and Reuters, showed the scale of the bet: $16.3 billion in first-half 2026 revenue against a net loss of $80.7 billion — though about $72 billion of that was a non-cash accounting charge tied to convertible notes. Third-quarter revenue hit $16.8 billion with adjusted profitability and positive cash flow, while long-term computing commitments run above $518 billion. Morgan Stanley, Goldman Sachs and JPMorgan are lined up to lead the offering, with the IPO roadshow expected the week of November 9 and trading before Thanksgiving. The filing would make Anthro...
Read more

Netflix Beats Earnings but Slashes Ad Forecast — Stock Tumbles After Hours

Image
Netflix made more money than Wall Street expected last quarter — but investors cared more about where growth is heading, and the streaming giant's stock slipped after hours on Tuesday. The company reported third-quarter revenue of $12.87 billion, up about 12% from a year earlier and in line with forecasts. Earnings per share came in at $0.87, beating the $0.82 analysts expected, while net income surged 44% to $3.66 billion. Operating margin widened to an impressive 34.6% from 28.2% a year ago. But Netflix cut its 2026 advertising revenue forecast to about $2.7 billion from roughly $3 billion, citing a slower-than-expected rollout of its ad products. Its fourth-quarter outlook also disappointed, sending shares down around 4–6% in after-hours trading. The company said it plans to bring its ad-supported plan to 15 additional countries in 2027. With subscriber growth steady and churn improving, the ad business is now the number investors are watching most closely. Source: read more
Read more