#litellm

Python package box marked with a warning symbol, sitting between the PyPI and Docker logos, with a stream of keys and credentials leaking out of it

SecurityOctober 23, 2026

LiteLLM 1.107.0 poisoned on PyPI and Docker: which secrets to rotate

On October 21, LiteLLM's release pipeline was compromised and a version 1.107.0 carrying a credential stealer was distributed on PyPI and Docker registries. If you installed or pulled this version, treat every secret on the machine as exposed.

The Monday letter

The tech and security week, every Monday in your inbox

What to patch first, data breaches, the articles with pictures. Free, no ads, one-click unsubscribe.