LiteLLM's v1.107.0 shipped a credential stealer — pin to 1.106.2
A malicious build sat on PyPI, Docker and GHCR for ~2 hours Oct 21, stealing cloud and AI-tool secrets. The blast radius, the fix, plus a local coder to grab.
Copy markdown
Two hours on PyPI, Docker and GHCR
Malicious litellm 1.107.0 was live on PyPI from 11:39–13:23 UTC on Oct 21, with poisoned v1.107.0, latest, main-latest and main-stable tags on Docker Hub and GHCR until ~14:20 UTC. A dropped cook.pth ran a stealer at Python startup, exfiltrating system, browser, cloud and AI-tool secrets; on Linux and macOS a second stage pulled hourly remote-code payloads.
Are you exposed?
You're hit only if you pip-installed unpinned LiteLLM inside that ~100-minute window, or pulled the bad Docker/GHCR tags before ~14:20 UTC; Enterprise users on the private registry were spared. Wiz reported stolen AWS keys were being tested within roughly 4.5 hours of exfiltration, so treat anything those hosts could reach as burned.
The cleanup, in order
Pin litellm==1.106.2 and rebuild any environment or image created during the window. Delete cook.pth, sitecustomize.py and the hourly daemon, block the exfil domain, then rotate every credential reachable from affected hosts. Going forward, pin container images by digest instead of tag.
Root cause still open
LiteLLM lists the incident as contained with the investigation ongoing. Reporting ties the breach to a GitHub OAuth token that surfaced in logs — reportedly after Claude Code embedded it in response bodies — letting an attacker push through a look-alike 'Berri-AI/litellm' repo. If you pipe gh auth through Claude Code, audit your logs.
Weekend grab: Recursive Flint
Recursive open-sourced Flint, a 40B/2.5B-active MoE coder under Apache 2.0 that reportedly scores ~89.7% on SWE-bench Pro v2 with a 262K context — and runs on a laptop. It's free on OpenRouter and loads in LM Studio, so you can wire a genuinely local coding agent into your editor this weekend.