LiteLLM, a widely deployed unified proxy gateway powering millions of LLM and autonomous agent pipelines worldwide (including LangChain and OpenHands), suffered a critical supply-chain compromise. Attackers breached its automated CI/CD release pipeline, pushing a poisoned v1.107.0 release to PyPI and Docker Hub tags ('latest' and 'main-stable') equipped with a credential-harvesting payload targeting system environment variables and cloud API keys. Coordinated with security firms including SlowMist, the maintainers quickly contained the incident, yanked v1.107.0, restored PyPI to 1.106.2, and urged all operators to pin dependency versions and rotate API credentials immediately.
Zoom
Key Takeaways
LiteLLM release pipeline compromised, publishing trojanized v1.107.0 packages across PyPI and Docker Hub tags
Payload secretly exfiltrated host environment variables, harvesting model API keys, database credentials, and cloud secrets
Maintainers yanked the malicious package within hours, rolling PyPI and official Docker containers back to stable 1.106.2
Urges all agent and LLM platform operators to verify pinned package versions and execute immediate credential rotation
On October 21 the release pipeline of the popular LLM gateway LiteLLM was compromised. A malicious 1.107.0 was live on PyPI for about two hours (11:39 to 13:23 UTC), and the Docker tags v1.107.0, latest, main-latest and main-stable pointed to a poisoned image from 11:46 to 14:20 UTC. LiteLLM's incident report says the payload steals cloud, SSH, AI-tool and proxy keys on every Python start; the artifacts are pulled, OSS users should pin 1.106.2 and rotate secrets, and the private enterprise registry was not affected.
Zoom
Key Takeaways
Scope (vendor figures): all 7 PyPI wheels of litellm==1.107.0, live 11:39:51 to 13:23 UTC; 4 Docker Hub and GHCR tags poisoned from 11:46:56 UTC
Attack chain: the attacker held 3 sets of developer GitHub CLI credentials, one belonging to an org owner, used it to disable branch protection and force-push, then had the release workflow build and sign from the lookalike repo Berri-AI/litellm
Payload: cook.pth, cook.py and sitecustomize.py run on any Python start and survive uninstalling litellm; a second loader fetches remote code hourly
Fix: delete the 3 files and matching .pyc first, then pin litellm==1.106.2 or rebuild from scratch, and rotate every provider key in the proxy DB, the master key and the database password
This is LiteLLM's second supply-chain incident of 2026 (versions 1.82.7/1.82.8 in March); the GitHub source tag v1.107.0 itself is clean
On Oct 7 LiteLLM open-sourced Moyai (BerriAI/moyai), the self-hosted background coding agent its team runs daily: tasks from Slack or the browser run in isolated cloud workspaces that edit code, run tests and open PRs. Harnesses (Claude Agent SDK, Codex, Hermes, OpenCode, Deep Agents, Tool Loop) are switchable per session and inference routes through LiteLLM's 100+ providers. LiteLLM says replacing Devin cut a 31-day bill from $101,872 to about $21,700.
Zoom
Key Takeaways
Cost: $101,872 on Devin vs ~$21,700 on Moyai (~$700/day) over the same 31 days, a claimed 79% / ~$80,172 saving (launch post)
Pluggable harnesses: Claude Agent SDK by default (prompt caching on), plus Hermes, Codex, OpenCode, Deep Agents and Tool Loop (docs)
Inference via LiteLLM across 100+ providers; switch GPT-6 Astra / Claude Opus 5.5 / GLM-5.3 mid-session with per-teammate spend attribution
Provider keys stay server-side and never reach the sandbox; each session gets its own terminal, filesystem and browser
Caveat: ~58 stars at publish time and no LICENSE file detected by GitHub; confirm terms before commercial use
BerriAI shipped LiteLLM v1.103.2 on 2026-10-01 (PyPI ~06:20Z; 17 commits vs 1.103.1): forward Claude Code safeguards / dangerous-tool-use beta unchanged to Anthropic, Bedrock, Vertex, and Azure AI Foundry so auto mode works behind the proxy; attribute CLI session spend to a per-user cli-session alias for daily activity BI; restore pre-config-wins for pass-through endpoints.
Zoom
Key Takeaways
Release v1.103.2 at 2026-10-01T06:37:31Z; 17 commits vs v1.103.1
Forward Claude Code safeguards + dangerous-tool-use beta to Anthropic/Bedrock/Vertex/Azure Foundry so auto mode returns safeguard_results
CLI session spend attributed to per-user cli-session alias for daily activity BI (#40541/#43642/#43656)
Restore pass-through pre-config-wins (#43962); verify Docker with cosign
LiteLLM v1.103.1 (PyPI ~2026-09-29T23:36Z; 5 commits ahead of 1.103.0) backports binding UI/CLI session tokens to their own AES-GCM encryption context (a80eaca), with e2e/OIDC and auth unit tests—security hardening for operators pinned on the 1.103.x stable line.
LiteLLM shipped v1.103.0, introducing native hosted_vllm offline batch processing and updating its MCP integration test suite to the modern MCP 2.x MCPServer architecture. The Admin UI now supports dynamic web search interception controls, while the proxy resolves reasoning-object to reasoning_effort translation for OpenAI o1/o3 series and eliminates Azure 400 errors on empty tool choices.
Zoom
Key Takeaways
Hosted vLLM Batching: Directly dispatches and tracks asynchronous batch inference across hosted vLLM clusters from unified LiteLLM client endpoints.
MCP 2.x Alignment & Budget Guardrails: Migrates test harnesses to the modern MCP 2.x MCPServer API while hardening zero-budget project request blocking and team-linked JWT inheritance.
Reasoning Effort & Azure Tool Fixes: Translates provider reasoning tokens into uniform reasoning_effort parameters and eliminates 400 errors on Azure tool_choice when no tools are attached.
BerriAI shipped LiteLLM v1.102.1 on 2026-09-23 (PyPI litellm 1.102.1). Versus 1.102.0 it backports Anthropic/Bedrock/Vertex safeguards→safeguard_results passthrough so Claude Code Auto mode through a LiteLLM gateway can show Auto mode server: Enabled, and cherry-picks seven TypeSafe Jev changes (passthrough, complexity router, relevance compaction guardrail, auto-router classifier, OpenRouter jev-1.13 pricing, etc.) from the 1.103 RC onto stable/1.102.x. Docker images keep cosign verify instructions.
Zoom
Key Takeaways
Shipped: v1.102.1 / PyPI 1.102.1
Claude Code: gateway forwards safeguards and returns safeguard_results (#42538) so Auto mode server can stay Enabled
TypeSafe Jev: seven PRs backported to stable/1.102.x (#42595)
