Post

Socket
@socket.dev

🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.

Socket
@socket.dev

Socket flagged all seven malicious wheels within seven minutes of publication. The malware runs at Python startup, even without importing LiteLLM. The release workflow built container images from a lookalike repository. Full analysis: socket.dev/blog/litellm...

1 repost2 likes

No replies yet.