The poisoned LiteLLM 1.107.0 problem, and the 30‑second check I now run on every repo

Description and use

The litellm-check tool automates detection of the compromised LiteLLM 1.107.0, inspecting specs, lockfiles, Dockerfiles, and installed environments, and supports CI gating.

Problem

A compromised LiteLLM 1.107.0 release exposed malicious wheels, Docker tags, and GHCR images, allowing any Python start on a suspect environment to re‑run an implant.

Outcome

Automated scanning reduces manual effort, provides evidence‑based findings, and supports CI gating, but only detects known indicators and cannot certify safety.

Workflow

• 1. Run litellm-check scan ./your-project to inspect the repository for vulnerable specs, lockfiles, Dockerfiles, and implant markers.
• 2. Run litellm-check scan ~/.virtualenvs to inspect installed environments without starting Python.
• 3. Review the generated report for matched spec/tag and announcement basis for each finding.
• 4. If critical findings are present, rebuild the environment from a clean version (e.g., litellm==1.106.2), rotate secrets, and check CloudTrail.
• 5. Use --fail-on critical in CI to block merges until remediation is complete.

Evidence

On Oct 21, LiteLLM disclosed that v1.107.0 shipped compromised — malicious wheels on PyPI (live 11:39–13:23 UTC), poisoned Docker tags (v1.107.0, latest, main-latest, main-stable, 11:46–14:20 UTC), and GHCR images (until 13:51 UTC).

Source

I packaged the above as litellm-check (13 rules, each mapped to a step in the official announcement)... Output is a Markdown or JSON evidence report — file:line, the matched spec/tag, and the announcement basis for each finding.

Source