Skip to main content
Published: 22 October 2026 · Status: Not affected Depict is not affected by the malicious LiteLLM release published on 21 October 2026.

​
What happened

On 21 October 2026 an attacker published a tampered release of LiteLLM, a Python library for calling AI models, as version 1.107.0 on PyPI and under the v1.107.0, latest, main-latest and main-stable Docker tags. The package installed a credential stealer and a remote code loader that ran whenever any Python process started on the host. The PyPI package was live from 11:39 to 13:23 UTC and the Docker images until 14:20 UTC. LiteLLM has asked anyone who installed that version during the window to treat the machine as compromised and rotate credentials.

​
Why Depict is not affected

Depict does not run the LiteLLM proxy or its Docker images, and no Depict service installed the affected release. Our Python dependencies are pinned to exact versions and reviewed before upgrade, so a tampered release cannot be pulled in automatically. After the disclosure we reviewed our application code, build pipelines and container images and found no use of version 1.107.0.

​
What merchants need to do

Nothing for Depict. You don’t need to update the app, change any code or rotate credentials or access tokens. If other vendors in your stack run Python services that use LiteLLM, check their advisories separately. If you need a written confirmation for your security records, contact support@depict.ai.