OSV advisory MAL-2026-2144: malicious litellm versions on PyPI
OSV · 1 source
What's on the official record
21 October — OSV flags three malicious litellm versions on PyPI. The OSV advisory MAL-2026-2144 reports malicious code in the PyPI package litellm, an LLM gateway. It flags three affected versions: 1.82.7, 1.82.8, and 1.107.0. The advisory states that litellm 1.107.0, uploaded to PyPI on 21 October 2026 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source; the v1.107.0 git tag of BerriAI/litellm does not contain them, and they were injected at build or upload time. The advisory names no fixed version, so the listed versions should be removed.
Assessment
For a platform or AI-stack owner, the advisory gives a concrete check: identify which pinned builds or container images carry litellm 1.82.7, 1.82.8, or 1.107.0, and pull or isolate those versions. Because the advisory describes a credential stealer in the injected code, any host that installed one of the three versions should have its credentials rotated. The advisory names no fixed version, so removal is the remediation the record supports.
For a deal team, litellm is an LLM gateway package, so a target that runs AI agents or model gateways is in scope for one diligence request-list item: whether any build installed versions 1.82.7, 1.82.8, or 1.107.0 between their upload and removal, and whether credentials on those hosts were rotated. The advisory's description of a credential stealer and remote code execution backdoor is what makes that item material to diligence scope.
What would change this call
A later OSV update naming a fixed version would change the remediation from removal to a targeted upgrade. A finding that a specific pinned build or image carries one of the three versions would move this from a general advisory to a concrete incident for that operator.
What to check next
| Check | Why it matters |
|---|---|
| Whether any pinned build or image carries litellm 1.82.7, 1.82.8, or 1.107.0 | Identifies hosts that need the version pulled and credentials rotated |
| Whether installed litellm matches the upstream BerriAI/litellm git tag | The advisory reports the injected code is absent from the upstream tag, so a mismatch flags a tampered build |
| A later OSV update naming a fixed version | Would turn removal into a targeted upgrade |
Confidence
Confidence is high on the official row: the advisory id, package, ecosystem, affected versions, and the absence of a fixed version are all stated in the record. Filed 23 October 2026 from the record dated 21 October 2026.
Sources
[1] OSV advisory MAL-2026-2144 — https://osv.dev/vulnerability/MAL-2026-2144