#safedep

October 22, 2026

LiteLLM 1.107.0 shipped a credential stealer and backdoor in all seven PyPI wheels and a published container image. Socket says startup hooks execute whenever Python starts—even without importing LiteLLM—and can steal cloud, developer and AI credentials or load remotely supplied Python. Container provenance points to Berri-AI/litellm, a lookalike of the legitimate BerriAI/litellm. Approximately 23 million downloads per week measures package reach, not infections. Stop deploying 1.107.0; investigate environments where Python ran, rebuild from verified artifacts and rotate exposed secrets. SafeDep adds technical analysis. (discussion) · Supply Chain & Developer Security