Latest / AnyMessages · Daily Podcast
LiteLLM Poisoned for Two Hours — LLM Gateway Nearly Becomes a Master Key
On the morning of October 21 UTC, LiteLLM 1.107.0 quietly appeared on PyPI with built-in stealers for browser keys, AWS credentials, and OpenAI/Anthropic API keys. It was pulled 2 hours and 14 minutes later, but the contamination had already spread to Docker images tagged 'latest'.
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.