software_project · DiggingBeagle record
LiteLLM
LiteLLM routes requests to multiple model providers. Its compromised 1.107.0 distribution exposed secrets through trusted package channels rather than a malicious model response.
- Entity kind
- software_project
Record description
LiteLLM provides an LLM gateway and proxy for routing requests to model providers. Its package distribution and access to provider credentials make release integrity central to its security boundary.
The October 2026 LiteLLM incident involved unauthorized PyPI and Docker distribution of 1.107.0 artifacts containing malicious startup code. The vendor's release removal timeline and Wiz's observed quarantine times differ by minutes and should be retained as separately attributed observations. The package's credential access is conditional on installation and execution; neither download counts nor the available forensic account establish the population of exploited end users. Case.
The source tag, build attestations and registry payload are three separate identities. A trusted workflow can still publish code from an attacker-controlled input; verifying only the tag leaves that substitution unexamined.