SlowMist said altered code in LiteLLM 1.107.0 may let attackers obtain cloud, AI and SSH credentials and execute code remotely on affected systems.
LiteLLM functions as an AI gateway, so organizations operating it are the users affected by the warning. SlowMist said the injected program can gather sensitive information and create a route for attackers to run code remotely. The credential types it identified cover cloud services, AI applications and SSH access.
The affected release appeared on PyPI and in Docker images. SlowMist also flagged latest and main-stable as affected image tags, separate from litellm 1.107.0, the compromised package version.
SlowMist classified the compromise as a supply-chain attack targeting LiteLLM. Its report places the Python package and Docker images in scope, with multiple credential categories potentially exposed.
SlowMist recommended pinning installations to version 1.106.2. For potentially affected environments, it advised rebuilding with clean images, rotating credentials that may have been exposed and avoiding version 1.107.0.
