Python and npm supply-chain lockdown kit: LiteLLM 1.107.0 check and an unpinned-install hook

A read-only script that checks a machine for the LiteLLM 1.107.0 indicators, plus a Claude Code hook that blocks unpinned pip and npm installs. Tested.

October 22, 2026 · By Derrick K.

Hand holding a brass padlock — Photo by Nathan Thomas on Pexels

#!/usr/bin/env python3
"""PreToolUse hook (Bash): block package installs that don't pin an exact version.

From codema.ai. Claude Code sends the tool call as JSON on stdin.
Exit code 2 blocks the command and shows stderr to Claude. Exit 0 allows it.

Blocked unless every package is pinned to an exact version:
  pip / pip3 / python -m pip / uv pip install   -> name==1.2.3
  uv add, poetry add                            -> name==1.2.3
  npm install|i|add, pnpm add|install, yarn add, bun add -> name@1.2.3

Allowed: installs from a lock or requirements file (npm ci, npm install,
pip install -r file), local paths (., ./pkg, /abs/path, *.whl, *.tgz).
This is a safety net, not a sandbox: a determined rewrite can slip past it.
"""
import json
import re
import shlex
import sys

EXACT_SEMVER = re.compile(r"^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$")
PIP_TAKES_VALUE = {"-r", "--requirement", "-c", "--constraint", "-e", "--editable",
                   "-i", "--index-url", "--extra-index-url", "-t", "--target",
                   "--prefix", "--root", "-f", "--find-links", "--python",
                   "--group", "--extra"}
NPM_TAKES_VALUE = {"--registry", "--prefix", "-w", "--workspace", "--filter", "--cwd"}
SEPARATORS = {"&&", "||", ";", "|", "&"}


def is_local(arg):
    return (arg in (".", "..") or arg.startswith(("./", "../", "/", "~", "file:"))
            or arg.endswith((".whl", ".tar.gz", ".tgz", ".zip")))


def pip_pinned(arg):
    # name==1.2.3 or name[extra]==1.2.3 ; reject ranges like >=, ~=, ===, *, or commas
    m = re.match(r"^[A-Za-z0-9_.\-]+(\[[A-Za-z0-9_,.\-]+\])?==([^=<>!~*,;\s]+)$", arg)
    return bool(m)


def npm_pinned(arg):
    name, sep, version = arg.rpartition("@")
    if not sep or not name or name == "@":   # no version, or just "@scope/pkg"
        return False
    return bool(EXACT_SEMVER.match(version))


def split_commands(tokens):
    cmd = []
    for tok in tokens:
        if tok in SEPARATORS:
            if cmd:
                yield cmd
            cmd = []
        else:
            cmd.append(tok)
    if cmd:
        yield cmd


def strip_prefix(cmd):
    # drop env assignments and wrappers like sudo / env
    while cmd and (re.match(r"^[A-Za-z_][A-Za-z0-9_]*=", cmd[0]) or cmd[0] in ("sudo", "env", "command")):
        cmd = cmd[1:]
    return cmd


def package_args(args, takes_value):
    out, skip = [], False
    for a in args:
        if skip:
            skip = False
            continue
        if a in takes_value:
            skip = True
            continue
        if a.startswith("-"):
            continue
        out.append(a)
    return out


def check(cmd):
    """Return a list of unpinned package args for one simple command."""
    cmd = strip_prefix(cmd)
    if not cmd:
        return []
    prog = cmd[0].rsplit("/", 1)[-1]
    rest = cmd[1:]
    kind = None
    if re.match(r"^pip(3(\.\d+)?)?$", prog) and rest[:1] == ["install"]:
        kind, args = "pip", rest[1:]
    elif re.match(r"^python(3(\.\d+)?)?$", prog) and rest[:3] == ["-m", "pip", "install"]:
        kind, args = "pip", rest[3:]
    elif prog == "uv" and rest[:2] == ["pip", "install"]:
        kind, args = "pip", rest[2:]
    elif prog in ("uv", "poetry") and rest[:1] == ["add"]:
        kind, args = "pip", rest[1:]
    elif prog == "npm" and rest[:1] and rest[0] in ("install", "i", "add", "in", "isntall"):
        kind, args = "npm", rest[1:]
    elif prog == "pnpm" and rest[:1] and rest[0] in ("add", "install", "i"):
        kind, args = "npm", rest[1:]
    elif prog in ("yarn", "bun") and rest[:1] == ["add"]:
        kind, args = "npm", rest[1:]
    if kind is None:
        return []
    takes = PIP_TAKES_VALUE if kind == "pip" else NPM_TAKES_VALUE
    pinned = pip_pinned if kind == "pip" else npm_pinned
    return [a for a in package_args(args, takes) if not is_local(a) and not pinned(a)]


def main():
    try:
        data = json.load(sys.stdin)
    except json.JSONDecodeError:
        return 0
    command = (data.get("tool_input") or {}).get("command") or ""
    try:
        lexer = shlex.shlex(command, posix=True, punctuation_chars=";&|")
        lexer.whitespace_split = True
        tokens = list(lexer)
    except ValueError:
        tokens = command.split()
    bad = []
    for cmd in split_commands(tokens):
        bad += check(cmd)
    if bad:
        print("Blocked: unpinned install of " + ", ".join(bad) + ". "
              "Pin an exact version (pip: name==1.2.3, npm: name@1.2.3), "
              "or ask the user to run it themselves.", file=sys.stderr)
        return 2
    return 0


if __name__ == "__main__":
    sys.exit(main())

Free account required

Download

On Oct 21, 2026, LiteLLM said version 1.107.0 on PyPI was malicious. This kit checks your machines for it and stops your coding agent from pulling an unpinned package next time. Background: LiteLLM 1.107.0 was compromised: how to check your machines.

Preview: check_litellm_1_107_0.py

# Run with -S so .pth files and sitecustomize.py are not loaded
python3 -S -I scripts/check_litellm_1_107_0.py ~/code ~/venvs --docker

# Exit codes: 0 = no indicators, 1 = indicators found, 3 = run without -S

It checks for litellm-1.107.0.dist-info, cook.pth, cook.py, an unexpected sitecustomize.py, their __pycache__ copies, the /tmp/remote_code_loader.lock lock file and, with --docker, local images whose digests start with the prefixes in the incident post.

What's inside

scripts/check_litellm_1_107_0.py: the read-only indicator check
.claude/hooks/block-unpinned-installs.py: blocks pip install litellm, allows pip install litellm==1.106.2
.claude/settings.json: registers the hook for the Bash tool
.npmrc: save-exact=true, so npm saves 1.2.3 instead of ^1.2.3
tests/test_kit.py: 19 blocked and 20 allowed commands, plus scanner tests on clean and fake infected folders
README.md: setup and limits

How to use it

Unzip the kit.
Run python3 -S -I scripts/check_litellm_1_107_0.py with the folders that hold your projects and virtualenvs.
Copy .claude/ into your project root. Merge the hooks key if you already have a settings file.
Type /hooks in Claude Code to check the hook is listed.
Test it: ask Claude to run pip install litellm. It should be blocked.
Optional: run python3 -m unittest discover -s tests -v.

Who it's for

Anyone who had LiteLLM in a project, and anyone who lets a coding agent install packages.

FAQ

Does the script clean an infected machine?

No. It only reads. If it finds indicators, follow the cleanup order in LiteLLM's incident post, then rotate your secrets.

Why does it need python3 -S?

The malware loads from a .pth file when Python starts. -S tells Python to skip site processing, so the check doesn't trigger the thing it's looking for.

Does the hook block npm install with no package name?

No. Bare npm install, pnpm install and npm ci install from your lockfile, so they're allowed. So is pip install -r requirements.txt, so pin that file too.

Can an agent get around the hook?

Yes, with a creative rewrite. It's a safety net, not a sandbox. It doesn't cover npx, uvx or curl | sh.

Keep reading

News

LiteLLM 1.107.0 was compromised: how to check your machines and what to rotate

On Oct 21, 2026, a malicious LiteLLM 1.107.0 shipped to PyPI, Docker Hub and GHCR for a few hours. Here's how to check whether you pulled it, how to clean up, and which secrets to rotate.

John F.October 22, 20266 min read

Build Guides

What is AGENTS.md? How to write one your coding agents follow

AGENTS.md is a Markdown file that tells AI coding agents how to work on your repo. What it is, which tools read it, and how to write one that works.

Codema EditorialOctober 21, 20266 min read