Vibe coding runs on trust: you describe the app, the tools pull in packages, and installs happen faster than anyone reads them. October 2026 showed what that trust costs — LiteLLM 1.107.0's tampered release stole credentials from one of the most-installed AI packages in the world. Paste a setup.py, an install hook, or a package.json scripts block below and scan it for the swap shapes before it ever runs on your machine.
Short answer: a release swap is when the version you install is not the version the maintainer built — the registry artifact was replaced or the maintainer account was used to publish a tampered one. The name, the version number and the download page all look right; only the install-time code changed. LiteLLM 1.107.0 reached about 23 million weekly downloads, per the October 2026 reporting, so a single swapped release is a credential harvest at population scale.
In October 2026, three separate ecosystems reported the same attack shape. LiteLLM 1.107.0 — a tampered release of the widely used AI gateway library — carried a credential stealer that ran at install and startup time, per the October 2026 reporting on the incident. The package's reach is what made it a harvest rather than a burglary: about 23 million weekly downloads means the swapped artifact flowed into laptops, CI pipelines and production images before anyone compared it against the maintainer's real build.
The same month, a Rank Math PRO release was reported backdoored — the WordPress plugin's update channel delivering code its users never reviewed — and OVHcloud CLI releases were swapped, per the October 2026 reports. A WordPress plugin update, a Python package and a cloud CLI have nothing in common except the trust path: in each case the victim installed or updated through the official channel, from the official name, at a plausible version. The swap does not break the trust path; it rides it.
The common payload shape is what this page scans for. Swapped releases need code that runs at install time, reaches the credentials on the machine, and sends them out — so they reach for subprocess calls, dynamic evaluation, base64-encoded payloads, network calls, and reads of .ssh and .aws. Those shapes are visible in the text you paste, before anything executes.
A release swap is the replacement of a legitimate software release with a tampered one under the same name and version — through a hijacked maintainer account, a compromised build pipeline, or a registry weakness. It differs from a malicious package, which is bad from its first upload: a swapped package has a real history, real users and a real reputation, all of which the attacker inherits. Detection therefore cannot rely on the package's name or popularity; it has to read what the specific artifact does at install time, which is why the scanner below works on the code, not the brand.
Paste a setup.py, the text of an install hook or postinstall script, or a package.json scripts block. Or load a built-in sample first: the tampered-style sample combines the classic shapes — a custom install class, an AWS credentials read, a base64-encoded collector URL and a subprocess call — while the clean sample shows an ordinary package with no install-time behaviour.
Honest scope note: this is a quick static peek at the text you paste — pattern matching in your browser, not a full analysis. It cannot unpack release archives, diff an artifact against the maintainer's source, or observe runtime behaviour, and a clean result is not a safety guarantee. The full tool is the open-source release-swap-detector repo by Ingenious AI, which compares registry artifacts against source repositories and flags the differences.
| Pattern | Severity | Why a swapped release needs it |
|---|---|---|
Credential locations (.ssh, .aws, key files) | CRITICAL | The theft step: the payload reads the keys and cloud credentials stored in your home directory. |
Download piped to a shell (curl | sh) | CRITICAL | The real payload never ships in the release at all — it is served at install time, so no review of the package can see it. |
| Persistence (cron, services, autostart) | CRITICAL | Turns one bad install into a foothold that survives deleting the package. |
subprocess, os.system, shell execution | HIGH | Escapes the language sandbox into your shell, tools and credential helpers. |
| Dynamic evaluation and base64 payloads | HIGH | Hides what will actually run from anyone skimming the source — a swap must survive a quick look. |
| Install hooks and network calls at install time | HIGH | The delivery mechanism and the exfiltration channel: code that runs on install and phones home. |
If the scanner flags code you have already installed or updated to, work this list in order — the install already ran, so the machine is the incident now:
A release swap is when the artifact you install under a trusted name and version is not the artifact the maintainer built — it was replaced through a hijacked account, a compromised pipeline or a registry weakness. The name, version and download page all look correct; only the code changed. LiteLLM 1.107.0 in October 2026 is the defining recent case.
Read the install-time code before it runs: look for custom install command classes, subprocess or os.system calls, base64 decoding, network requests, dynamic code evaluation, and any reference to .ssh, .aws or credential files. The scanner on this page flags each of those shapes line by line in your browser, with a plain-English explanation of each hit.
Install time is the one moment code from a package executes automatically, with the installing user's permissions, files and environment — no import, no click, no vulnerability required. A credential stealer placed in an install hook runs on every laptop and CI runner that installs the package, which is why October 2026's swaps all carried install-time payloads.
No — popularity is what the attacker is buying. LiteLLM's tampered 1.107.0 reached an ecosystem with about 23 million weekly downloads, per the October 2026 reporting, so one swapped release harvested at population scale. A famous name tells you the package was worth swapping; it says nothing about the artifact you are about to install.
This page pattern-matches the text you paste. The full release-swap-detector downloads the actual registry artifact, unpacks it, and diffs its contents against the maintainer's source repository at the same version, flagging code that exists in the release but not in the source — use it before concluding any suspect release was clean.