Incident Ā· PyPI

Was I hit by LiteLLM 1.107.0?

LiteLLMā€™s PyPI package was reported compromised. Weā€™ve pre-filled an example below. Replace it with your own requirements.txt or poetry.lock and press Check.

Try a sample:
or drop a file here
If youā€™re affected: uninstall that version, pin a known-good release, and rotate any API keys or secrets on machines that installed it. OSV.dev may take time to list new incidents, so also check the official LiteLLM advisory.

How it works

Private by design

1Paste or drop a lockfile

requirements.txt, poetry.lock, package-lock.json or yarn.lock.

2Parsed in your browser

Your file is never uploaded to Caldrel. Only package names and versions go to OSV.dev.

3Get a clear answer

Known vulnerabilities and malicious packages, with the version to upgrade to.

Is my file uploaded?

No. Your file is read in your browser and never sent to Caldrel. Only package names and versions are sent to OSV.dev, Googleā€™s open vulnerability database.

Does a clean result mean Iā€™m safe?

Not a guarantee. It only finds issues already published in OSV.dev, and new attacks may not be listed yet.

Which formats work?

requirements.txt (exact == pins), poetry.lock, package-lock.json and yarn.lock. More formats are planned.

One short email a week

The AI and tech news that matters, plus patch-now alerts. Signups open soon. Follow @CaldrelHQ to hear first.

Get notified