{"id":7190,"date":"2026-10-21T14:00:00","date_gmt":"2026-10-21T14:00:00","guid":{"rendered":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels"},"modified":"2026-10-21T14:00:00","modified_gmt":"2026-10-21T14:00:00","slug":"litellm-1-107-0-backdoored-pypi-wheels","status":"publish","type":"post","link":"https:\/\/i10x.ai\/news\/litellm-1-107-0-backdoored-pypi-wheels","title":{"rendered":"LiteLLM 1.107.0 Wheels Were Backdoored to Steal Credentials and Load Remote Code"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">A standard <code>pip install<\/code> was enough. In the early hours of October 21, 2026, LiteLLM&#8217;s release pipeline published version 1.107.0 with a credential stealer and a remote-code loader inside every official wheel. The company&#8217;s <a href=\"https:\/\/docs.litellm.ai\/blog\/security-incident-oct-21-2026\" target=\"_blank\" rel=\"noreferrer noopener\">incident report<\/a> says a malicious <code>litellm==1.107.0<\/code> package &#8220;was published to PyPI and was live for approximately 2 hours (11:39 UTC to 13:23 UTC).&#8221; Docker images <code>v1.107.0<\/code>, <code>latest<\/code>, <code>main-latest<\/code> and <code>main-stable<\/code> were compromised from 11:46 to 14:20 UTC. &#8220;All previous versions are safe, and the impacted releases have been pulled. Enterprise Customers running the private enterprise release of LiteLLM were not impacted.&#8221;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u26a1 Quick Take<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>What shipped:<\/strong> All seven PyPI wheels for 1.107.0, plus official Docker Hub and GHCR tags, contained <code>cook.pth<\/code>, <code>cook.py<\/code> and <code>sitecustomize.py<\/code>. The payload runs at Python startup, even if the app never imports LiteLLM.<\/li><li><strong>What was clean:<\/strong> The official GitHub source tag for 1.107.0 did not contain the malicious files. The wheels were built from an attacker-controlled lookalike repository, <code>Berri-AI\/litellm<\/code> rather than <code>BerriAI\/litellm<\/code>.<\/li><li><strong>If you are affected:<\/strong> Do not start Python or pip in that environment. Delete the payload files from site-packages first, kill the loader daemon that holds <code>\/tmp\/remote_code_loader.lock<\/code>, rebuild and pin <code>litellm==1.106.2<\/code>, then rotate every secret the host could reach.<\/li><li><strong>Context:<\/strong> JFrog notes this is LiteLLM&#8217;s second documented hijacking in 2026, after a March incident. Socket later reported that secret-exfiltration workflows had already run in the real repository on October 10 and 12, eleven days before the release.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What happened<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/research.jfrog.com\/post\/litellm-hijacked-again\/\" target=\"_blank\" rel=\"noreferrer noopener\">JFrog Security Research analysis<\/a> is the clearest technical account of the package itself: the wheels are a functional copy of the legitimate project plus three startup-hook files. Because they live in the wheel&#8217;s <code>purelib<\/code> and are hooked through <code>.pth<\/code> and <code>sitecustomize<\/code>, any Python interpreter start in that environment runs the malware. The published source distribution did not include those three files, so a review of the Git tag or the sdist would miss them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">LiteLLM&#8217;s own timeline says an attacker who had obtained GitHub CLI OAuth tokens \u2014 the company believes from logs of an internal LiteLLM deployment, in which Claude Code had embedded tokens in a response body \u2014 overrode branch protections, pointed the release workflow at the lookalike repo, and pushed the poisoned artifacts through the official publishing path. PyPI removed 1.107.0 by 13:23 UTC; Docker Hub tags were cleaned by 14:20.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The company later cautioned that some early statements in the post were &#8220;inaccurate or incomplete&#8221; and pointed to a canonical record. The containment facts, affected artifacts, and user remediation steps above are from the published incident report as it stood, including those later caveats.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/socket.dev\/blog\/litellm-attack-timeline\" target=\"_blank\" rel=\"noreferrer noopener\">Socket<\/a> subsequently reported a longer compromise window: malicious <code>cache.yml<\/code> workflows on short-lived <code>ci-tmp-*<\/code> branches in <code>BerriAI\/litellm<\/code> ran successfully on October 10 and October 12, then the branches were deleted. That finding does not change the user remediation for 1.107.0; it does change how long the GitHub organization should be assumed to have been accessible to the attacker.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What you should do<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Follow LiteLLM&#8217;s order of operations, which it credits to an external helper:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Do not run <code>pip install<\/code> or start Python in a suspect venv or image first \u2014 that re-runs the payload.<\/li><li>Delete <code>cook.pth<\/code>, <code>cook.py<\/code>, <code>sitecustomize.py<\/code> and matching bytecode from every affected site-packages, then kill the detached Python process holding <code>\/tmp\/remote_code_loader.lock<\/code>.<\/li><li>Rebuild from scratch and pin <code>litellm==1.106.2<\/code> (or another verified later release, once you trust the new signing key LiteLLM rotated on October 23).<\/li><li>If the host had outbound internet, assume exfiltration succeeded. Rotate instance IAM roles, every provider key in the LiteLLM proxy database, master and virtual keys, the <code>DATABASE_URL<\/code> password, and any other secret in the environment. Check CloudTrail for <code>GetCallerIdentity<\/code> from the instance role around install time.<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What it means<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">LiteLLM sits in front of a lot of production model traffic, which is why a two-hour window still matters: CI jobs and unpinned <code>latest<\/code> tags can install a release in minutes. The second 2026 compromise, the lookalike-repo trick, and Socket&#8217;s evidence of earlier secret-stealing workflows make this more than a one-off typo in a pipeline. If you consumed 1.107.0, the incident is not over when the package is yanked; it is over when the secrets that machine could see have been rotated and the environment has been rebuilt.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u270d\ufe0f About the analysis<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This i10x report is based on LiteLLM&#8217;s October 21 incident report (including later updates on that page), JFrog&#8217;s technical analysis, and Socket&#8217;s follow-up on the October 10\u201312 workflows. i10x did not analyze the malicious wheels.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/docs.litellm.ai\/blog\/security-incident-oct-21-2026\" target=\"_blank\" rel=\"noreferrer noopener\">LiteLLM: October 21, 2026 incident report for v1.107.0<\/a><\/li><li><a href=\"https:\/\/research.jfrog.com\/post\/litellm-hijacked-again\/\" target=\"_blank\" rel=\"noreferrer noopener\">JFrog Security Research: LiteLLM hijacked again<\/a><\/li><li><a href=\"https:\/\/socket.dev\/blog\/litellm-attack-timeline\" target=\"_blank\" rel=\"noreferrer noopener\">Socket: malicious workflows ran 11 days before the 1.107.0 release<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>LiteLLM\u2019s release pipeline was compromised on October 21, 2026. Version 1.107.0\u2019s seven PyPI wheels, live for about two hours, and several Docker and GHCR tags contained malware that steals credentials and loads remote code even if an application never imports LiteLLM. Enterprise private-registry customers were not affected.<\/p>\n","protected":false},"author":2,"featured_media":7189,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"paper_title":"","paper_url":"","pdf_url":"","doi":"","arxiv_id":"","authors":"","institutions":"","paper_date":"","venue":"","peer_reviewed":false,"code_url":"","data_url":"","funding_coi":"","figure_license":"","paper_license":"","replication":"","study_models":"","study_sample":"","footnotes":"","_yoast_wpseo_primary_category":"65","_nx_sec_severity":"critical","_nx_sec_affected":"LiteLLM","_nx_sec_status":"mitigated","_nx_sec_kicker":"DANGER: LiteLLM 1.107.0 wheels were a credential stealer"},"categories":[14,65,22,11,12,28],"tags":[],"companies":[],"products":[],"class_list":["post-7190","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-agents","category-ai-security","category-coding","category-infrastructure","category-policy-safety","category-security-defense"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LiteLLM 1.107.0 Backdoor: Pin 1.106.2, Rotate Keys<\/title>\n<meta name=\"description\" content=\"LiteLLM 1.107.0 wheels were backdoored on October 21, 2026, live on PyPI for about two hours. Pin 1.106.2, rebuild environments, and rotate secrets.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LiteLLM 1.107.0 Backdoor: Pin 1.106.2, Rotate Keys\" \/>\n<meta property=\"og:description\" content=\"LiteLLM 1.107.0 wheels were backdoored on October 21, 2026, live on PyPI for about two hours. Pin 1.106.2, rebuild environments, and rotate secrets.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels\" \/>\n<meta property=\"og:site_name\" content=\"i10X News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-21T14:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/litellm-1-107-0-backdoored-pypi-wheels-title.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1344\" \/>\n\t<meta property=\"og:image:height\" content=\"768\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Christopher Ort\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:site\" content=\"@i10x_ai\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Christopher Ort\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels\"},\"author\":{\"name\":\"Christopher Ort\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\"},\"headline\":\"LiteLLM 1.107.0 Wheels Were Backdoored to Steal Credentials and Load Remote Code\",\"datePublished\":\"2026-10-21T14:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels\"},\"wordCount\":723,\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/litellm-1-107-0-backdoored-pypi-wheels-title.webp\",\"articleSection\":[\"Agents\",\"AI Security\",\"Coding\",\"Infrastructure\",\"Policy &amp; Safety\",\"Security &amp; Defense\"],\"inLanguage\":\"en-US\",\"dateModified\":\"2026-10-21T14:00:00+00:00\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels\",\"name\":\"LiteLLM 1.107.0 Backdoor: Pin 1.106.2, Rotate Keys\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/litellm-1-107-0-backdoored-pypi-wheels-title.webp\",\"datePublished\":\"2026-10-21T14:00:00+00:00\",\"description\":\"LiteLLM 1.107.0 wheels were backdoored on October 21, 2026, live on PyPI for about two hours. Pin 1.106.2, rebuild environments, and rotate secrets.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/litellm-1-107-0-backdoored-pypi-wheels-title.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/litellm-1-107-0-backdoored-pypi-wheels-title.webp\",\"width\":1344,\"height\":768,\"caption\":\"A packaging warehouse table with sealed cardboard boxes and a handheld scanner, overhead warehouse light, no logos.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/litellm-1-107-0-backdoored-pypi-wheels#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/i10x.ai\\\/news\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LiteLLM 1.107.0 Wheels Were Backdoored to Steal Credentials and Load Remote Code\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#website\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\",\"name\":\"i10X News\",\"description\":\"Stay updated with the latest news and announcements from i10X.\",\"publisher\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/i10x.ai\\\/news?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\",\"name\":\"i10X\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"contentUrl\":\"https:\\\/\\\/i10xnews.kinsta.cloud\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/i10x-logo-180.png\",\"width\":180,\"height\":180,\"caption\":\"i10X\"},\"image\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/i10x_ai\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/i10x-ai\",\"https:\\\/\\\/instagram.com\\\/i10x.ai\",\"https:\\\/\\\/www.youtube.com\\\/@i10X_ai_official\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#\\\/schema\\\/person\\\/d410bb7ee72febefca2c9c369939219a\",\"name\":\"Christopher Ort\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"contentUrl\":\"https:\\\/\\\/i10x.ai\\\/news\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/christopher-ort-192.webp\",\"caption\":\"Christopher Ort\"},\"description\":\"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.\",\"url\":\"https:\\\/\\\/i10x.ai\\\/news\\\/author\\\/christopher-ort\",\"sameAs\":[\"https:\\\/\\\/i10x.ai\\\/blog\\\/author\\\/christopher-ort\"],\"worksFor\":{\"@id\":\"https:\\\/\\\/i10x.ai\\\/news\\\/#organization\"},\"alumniOf\":{\"@type\":\"EducationalOrganization\",\"name\":\"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)\",\"url\":\"https:\\\/\\\/www.fau.eu\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LiteLLM 1.107.0 Backdoor: Pin 1.106.2, Rotate Keys","description":"LiteLLM 1.107.0 wheels were backdoored on October 21, 2026, live on PyPI for about two hours. Pin 1.106.2, rebuild environments, and rotate secrets.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels","og_locale":"en_US","og_type":"article","og_title":"LiteLLM 1.107.0 Backdoor: Pin 1.106.2, Rotate Keys","og_description":"LiteLLM 1.107.0 wheels were backdoored on October 21, 2026, live on PyPI for about two hours. Pin 1.106.2, rebuild environments, and rotate secrets.","og_url":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels","og_site_name":"i10X News","article_published_time":"2026-10-21T14:00:00+00:00","og_image":[{"width":1344,"height":768,"url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/11\/litellm-1-107-0-backdoored-pypi-wheels-title.webp","type":"image\/webp"}],"author":"Christopher Ort","twitter_card":"summary_large_image","twitter_creator":"@i10x_ai","twitter_site":"@i10x_ai","twitter_misc":{"Written by":"Christopher Ort","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels#article","isPartOf":{"@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels"},"author":{"name":"Christopher Ort","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a"},"headline":"LiteLLM 1.107.0 Wheels Were Backdoored to Steal Credentials and Load Remote Code","datePublished":"2026-10-21T14:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels"},"wordCount":723,"publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/litellm-1-107-0-backdoored-pypi-wheels-title.webp","articleSection":["Agents","AI Security","Coding","Infrastructure","Policy &amp; Safety","Security &amp; Defense"],"inLanguage":"en-US","dateModified":"2026-10-21T14:00:00+00:00"},{"@type":"WebPage","@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels","url":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels","name":"LiteLLM 1.107.0 Backdoor: Pin 1.106.2, Rotate Keys","isPartOf":{"@id":"https:\/\/i10x.ai\/news\/#website"},"primaryImageOfPage":{"@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage"},"image":{"@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage"},"thumbnailUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/litellm-1-107-0-backdoored-pypi-wheels-title.webp","datePublished":"2026-10-21T14:00:00+00:00","description":"LiteLLM 1.107.0 wheels were backdoored on October 21, 2026, live on PyPI for about two hours. Pin 1.106.2, rebuild environments, and rotate secrets.","breadcrumb":{"@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels#primaryimage","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/litellm-1-107-0-backdoored-pypi-wheels-title.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/11\/litellm-1-107-0-backdoored-pypi-wheels-title.webp","width":1344,"height":768,"caption":"A packaging warehouse table with sealed cardboard boxes and a handheld scanner, overhead warehouse light, no logos."},{"@type":"BreadcrumbList","@id":"https:\/\/i10xnews.kinsta.cloud\/litellm-1-107-0-backdoored-pypi-wheels#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/i10x.ai\/news"},{"@type":"ListItem","position":2,"name":"LiteLLM 1.107.0 Wheels Were Backdoored to Steal Credentials and Load Remote Code"}]},{"@type":"WebSite","@id":"https:\/\/i10x.ai\/news\/#website","url":"https:\/\/i10x.ai\/news","name":"i10X News","description":"Stay updated with the latest news and announcements from i10X.","publisher":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/i10x.ai\/news?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/i10x.ai\/news\/#organization","name":"i10X","url":"https:\/\/i10x.ai\/news\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/","url":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","contentUrl":"https:\/\/i10xnews.kinsta.cloud\/wp-content\/uploads\/2026\/10\/i10x-logo-180.png","width":180,"height":180,"caption":"i10X"},"image":{"@id":"https:\/\/i10x.ai\/news\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/i10x_ai","https:\/\/www.linkedin.com\/company\/i10x-ai","https:\/\/instagram.com\/i10x.ai","https:\/\/www.youtube.com\/@i10X_ai_official"]},{"@type":"Person","@id":"https:\/\/i10x.ai\/news\/#\/schema\/person\/d410bb7ee72febefca2c9c369939219a","name":"Christopher Ort","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","url":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","contentUrl":"https:\/\/i10x.ai\/news\/wp-content\/uploads\/2026\/10\/christopher-ort-192.webp","caption":"Christopher Ort"},"description":"Christopher Ort handles SEO, AI agent workflows and PR & partnerships at i10x.ai, the all-in-one AI workspace built by i10X Global Pte. Ltd. in Singapore. He is a graduate of Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU). He is the author of \u201cThe Style Penalty\u201d, a study published on SSRN that analyses 1,576 evaluation decisions by four frontier AI models to show how AI-written CVs fare in automated hiring screens; the research has been covered by heise online and t3n.","url":"https:\/\/i10x.ai\/news\/author\/christopher-ort","sameAs":["https:\/\/i10x.ai\/blog\/author\/christopher-ort"],"worksFor":{"@id":"https:\/\/i10x.ai\/news\/#organization"},"alumniOf":{"@type":"EducationalOrganization","name":"Friedrich-Alexander-Universit\u00e4t Erlangen-N\u00fcrnberg (FAU)","url":"https:\/\/www.fau.eu"}}]}},"_links":{"self":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/comments?post=7190"}],"version-history":[{"count":0,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/posts\/7190\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media\/7189"}],"wp:attachment":[{"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/media?parent=7190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/categories?post=7190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/tags?post=7190"},{"taxonomy":"company","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/companies?post=7190"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/i10x.ai\/news\/wp-json\/wp\/v2\/products?post=7190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}