LiteLLM warns v1.107.0 users to assume affected environments are compromised

Top News

An unpinned LiteLLM pip install between 11:39 and 13:23 UTC on October 21 needs immediate attention. So does a pull of a named compromised Docker tag during its exposure window. The compromised artifacts carried credential-stealing malware and remote-code execution tools.

Here's what to check:

• The compromised PyPI package was litellm==1.107.0, and all seven wheels were affected.
• Docker Hub tags v1.107.0, latest, main-latest, and main-stable pointed to the compromised image from 11:46:56 to 14:20 UTC. Corresponding GHCR tags were affected until they were made unavailable by 13:51 UTC.
• Assume affected environments are compromised. Avoid Python startup and pip initially, follow the advisory's cleanup steps, terminate the detached daemon, rebuild where possible, and rotate credentials the host could access.
• Pin to version 1.106.2 or another explicit version published before the incident.

One catch: The unaffected enterprise exception covers only customers pulling the private enterprise release, not enterprise users generally.

Sources: docs.litellm.ai