LiteLLM 1.107.0 on PyPI was compromised with a credential stealer and backdoor, according

Prewire · case file · public copy of the record

FILE P324 PREWIRE receipts archive the live wire

CATCH #2224 DETECTED OCT 21, 2026 16:23 UTC

THE CATCHscore 10/10

EXHIBIT 2224 · FLASH

Oct 21, 2026 16:23 UTC hacker news https://news.ycombinator.com/item?id=50181114

LiteLLM 1.107.0 on PyPI was compromised with a credential stealer and backdoor, according to a fast-moving HN story.

READY TO POST:

heads up if you use litellm! version 1.107.0 on pypi reportedly includes a credential stealer and backdoor. check your dependencies!

huge security warning: litellm's 1.107.0 release on pypi was compromised. definitely look into this if you're pulling that version.

EVIDENCE — the receipts

HN story climbing fast:
title: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
points: 97 in 2.4h = 41 pts/hr
link: https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
discussion: https://news.ycombinator.com/item?id=50181114

caught by the 20-minute sweep · the live wire · all receipts

THE WIRE RECEIPTS ACCESS @VEDOLOS TERMS PRIVACY break the story before it breaks