LiteLLM 1.107.0 was a poisoned release: malicious code ran through Python startup hooks and stole credentials without LiteLLM ever being imported
Microsoft takes apart the malicious LiteLLM release pushed to PyPI and the official container images on October 21: how it triggered, what it could reach, and why removing the package isn't recovery.
// Key points
- On October 21 a tampered LiteLLM 1.107.0 was published to PyPI and shipped in the official container images. Its cook.pth, cook.py and sitecustomize.py run during Python initialization, so simply starting Python in an affected environment could trigger them.
- According to the LiteLLM maintainers, stolen developer GitHub credentials were used to redirect the release workflow to the lookalike repository Berri-AI/litellm, and another developer's credential satisfied the production approval step.
- The collector went after credentials for developer tools, cloud, browsers and SSH, plus environment variables; a separate module tried to read credentials and model configuration from the LiteLLM proxy database. On Unix it could also fetch and run more code.
- Microsoft's advice: don't run Python or pip inside a suspect environment to check; rebuild rather than just uninstall, rotate reachable credentials from a clean machine, and move to hash-pinned lock files and image digests.
Builder's takeA model gateway holds more keys than anything else in the stack, and this time CI runners and laptops that merely had it installed were exposed too. I'd grep every lock file and image for 1.107.0, treat any hit as a credential leak and rotate everything; from now on pin gateway images by digest and review upgrades by hand instead of pulling floating tags.
// Background · from #AI agents
Full timeline →- Oct 24 AWS shows the full bill for one multi-turn RL run: about $339 took gpt-oss-20b from a 61% to an 84% Wordle solve rate
- Oct 23 Anthropic donates the Agent Skills standard to the Linux Foundation's AAIF: more than 70 agent platforms, about 1 million skills published and nearly 280 million installs
- Oct 23 SageMaker AI training sessions are generally available: write your own post-training loop and reward function while AWS runs the GPUs, billed by tokens processed