LiteLLM Sweep: find the poisoned 1.107.0 and rotate every provider key it held

The incident is real. LiteLLM 1.107.0 wheels and Docker images were malicious on October 21, 2026, and this is the second LiteLLM compromise in seven months after 1.82.7/1.82.8 in March. But detection is already well covered. The maintainers, about a dozen security vendors, and a free open-source IOC scanner (scan-litellm-compromise) that can add a 1.107.0 profile quickly all publish the indicators. A tool built only for 1.107.0 also has a shelf life of days to weeks, and nobody pays a subscription for a single incident. The underused piece is the second half of the sweep. Take a compromised host. List every LLM provider key and cloud key it could reach: environment variables, the LiteLLM config.yaml and its database of virtual keys, .env files, cloud credential files and CI secrets. Then link straight to the revoke page for each provider (OpenAI, Anthropic, Azure OpenAI, Bedrock, Vertex, Groq, Mistral and the long tail LiteLLM routes to). Then check that each old key now fails authentication. TruffleHog finds and verifies keys but does not walk you through rotation, and the vendor checklists only say "rotate everything." A version of this that could win would be a general "LLM gateway blast radius and rotation" CLI, offered as open source with a paid team tier. It would know LiteLLM, OpenRouter-style and Portkey-style configs, and it would handle each new supply-chain incident as a new profile instead of a new product. It would also need to be at least as easy to trust as TruffleHog, since users are handing it their secrets. The PyPI cooldown proxy idea is effectively taken. uv and pip now have native cooldowns. git-pkgs proxy is a free open-source cooldown proxy. Cloudsmith, StepSecurity Secure Registry and SafeDep PMG sell or give away the same thing. Small teams can get this for free with one line of config, so there is little room to charge for it unless it is bundled into the rotation product.

• LiteLLM official incident post (Oct 21, 2026)

  Confirms the 1.107.0 wheels and Docker images were malicious for a window of about two hours, says 1.106.2 is safe, and tells anyone who installed it to assume compromise. The maintainers own the free remediation story, and it is less than a day old.

• scan-litellm-compromise (CognitiveSand)

  Free open-source IOC scanner built after the March 2026 1.82.7/1.82.8 compromise. It now uses data-driven threat profiles across PyPI and npm, so adding a 1.107.0 profile for cook.pth, cook.py and sitecustomize.py is a small change. It is the closest direct substitute for the detection half.

• Wiz, Datadog, Socket, Endor Labs, SafeDep, StepSecurity, Mend, JFrog, Chainguard, AISLE, Upwind, Ox write-ups

  Within hours, a dozen vendors published IOCs, wheel hashes and lists of exposed credentials. Several of them, including Wiz, Datadog, Socket and Endor, already detect this in their paid products for customers. Their free blog checklists cover most of what a solo developer needs. See also https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/ and https://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials

• TruffleHog (verify and analyze)

  Free open-source tool that finds secrets in files and environments and checks live whether each one still works. That covers much of the 'list reachable keys' step and the 'confirm the old keys are dead' step. It does not revoke keys or walk users through rotation.

• uv exclude-newer and pip --uploaded-prior-to

  The package managers now ship cooldowns natively. uv supports rolling durations and per-package exceptions. pip 26.1 accepts relative durations. Both are free and remove most of the reason to run a proxy for small teams.

• git-pkgs proxy

  Open-source caching registry proxy. It hides versions newer than a cooldown window from metadata, supports PyPI, and allows per-package overrides. This is essentially the Install Gate idea, already free.

• Cloudsmith cooldown policies

  Commercial registry that enforces cooldown windows at the index level for newly published packages.

• StepSecurity Secure Registry

  Proxy that sits between npm/PyPI and developer machines and CI, and blocks versions flagged by threat intelligence. It is aimed at the same CI use case.

• SafeDep PMG

  Client-side wrapper for pip and npm that drops versions published inside a configured cooldown window.

• gestate

  Writes min-release-age settings into each tool's native config (uv exclude-newer, pip uploaded-prior-to). It is a cheap way to get cooldowns without running a proxy.

Checked 2026-10-22