LiteLLM 1.107.0 PyPI Supply-Chain Compromise: How a Malicious Python Package Stole Credentials at Every Startup
On 21 Oct 2026 a malicious LiteLLM 1.107.0 reached PyPI and Docker for ~2 hours, installing a credential stealer that runs on every Python startup. Here’s what happened and how to respond.