Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Re:Compromised LiteLLM 1.107.0 on PyPI Installs a Credential... by joshheitzman on Wednesday October 21, 2026 @10:01PM (#50190244)

> specific situations in which Claude Code will embed a user's GitHub CLI OAuth token into a response body, and in situations where response bodies are logged, these tokens may appear in LiteLLM logs.

That's pretty hand wavy. What did y'all have CC doing that it had your GitHub CLI OAuth token in its context at all?

Stuff like this is why my coding agent is a coding agent not shell agent that basically own the machine. Mine has no tool for shell use narrow tools specific things like ripgrep, finding files, and deleting files that limit the paths to explicit workspace directory.

I take care of commits, push/pull, building wheels, and publishing wheels myself. It really doesn't take the much time and the coding agent frees up a lot of my time.

[ Parent | on HN ]

Re:Compromised LiteLLM 1.107.0 on PyPI Installs a Credential... by altbdoor on Wednesday October 21, 2026 @10:33PM (#50190468)

> I take care of commits, push/pull, building wheels, and publishing wheels myself.

I too was surprised when I see my colleagues telling me that these actions are "not maximizing your efficiency".

They'd rather hand all controls to the LLM, and then be surprised when shit hits the fan.

[ Parent | on HN ]

Re:Compromised LiteLLM 1.107.0 on PyPI Installs a Credential... by joshheitzman on Wednesday October 21, 2026 @10:39PM (#50190502)

Yeah, I don't get either. I look at source control as the first line of defense for when agents screw up to badly. I'm not going let the agent mess with the easiest way to undo its screw ups.

[ Parent | on HN ]

Re:Compromised LiteLLM 1.107.0 on PyPI Installs a Credential... by craftkiller on Thursday October 22, 2026 @01:47PM (#50198728)

> narrow tools specific things like ripgrep

Ripgrep has the `--pre` flag and `--hostname-bin` flag that enables it to execute arbitrary commands.

> finding files, [...]

Does that tool invoke the `find` command? Because `find` has the `-exec` flag which could then be used to invoke arbitrary commands.

I really think the only safe option is putting your agent in a virtual machine with only a copy of your code (sans credentials), let the agent work, and then copy it back and manually audit it.

[ Parent | on HN ]

Re:Compromised LiteLLM 1.107.0 on PyPI Installs a Credential... by joshheitzman on Saturday October 24, 2026 @12:29PM (#50222811)

The implementation of the tools don't execute processes (i.e. the implementations aren't wrappers for shell commands).

[ Parent | on HN ]