LiteLLM 1.107.0 Was Compromised; Pin 1.106.2 and Rotate Keys

Pin, then rotate.

“LiteLLM has been compromised,” @MiaAI_lab warned this afternoon. Her advice: if you installed 1.107.0, pin 1.106.2 and rotate your keys.

She cites a write-up on Aikido’s blog and a GitHub issue on the LiteLLM project. Asked whether this wasn’t the first time, she replied: “not the first time.”

Our Afternoon Feature on the Security desk explains how the release was poisoned, the exact windows when it was live, and how to check whether your machines ran it.