Incident · PyPI

Was I hit by LiteLLM 1.107.0?

LiteLLM’s PyPI package was reported compromised. We’ve pre-filled an example below. Replace it with your own requirements.txt or poetry.lock and press Check.

Try a sample:

Upload file

or drop a file here

Note: OSV.dev can take time to list new incidents. LiteLLM’s own disclosure has the definitive list of affected builds. Background: what happened in the LiteLLM 1.107.0 attack.

Disclaimer: this is a best-effort check based on public data from OSV.dev. It can miss issues that aren’t listed yet, and it is not a security audit or guarantee. Your file never leaves your browser; only package names and versions are sent to OSV.dev. See our terms.

How it works

Private by design

1Paste or drop a lockfile

requirements.txt, poetry.lock, package-lock.json or yarn.lock.

2Parsed in your browser

Your file is never uploaded to Caldrel. Only package names and versions go to OSV.dev.

3See the results

Known vulnerabilities and malicious-package reports, with fixed versions where OSV.dev lists them.

Is my file uploaded?

No. Your file is read in your browser and never sent to Caldrel. Only package names and versions are sent to OSV.dev, Google’s open vulnerability database.

Does a clean result mean I’m safe?

Not a guarantee. It only finds issues already published in OSV.dev, and new attacks may not be listed yet.

Which formats work?

requirements.txt (exact == pins), poetry.lock, package-lock.json and yarn.lock. More formats are planned.

One short email a week

A weekly roundup of tech, AI and security news. Signups aren’t open yet. Follow @CaldrelHQ on 𝕏 to hear when they are.

Follow @CaldrelHQ on 𝕏