LiteLLM 1.107.0 supply chain compromise enabled credential theft through Python startup hooks

According to Microsoft’s analysis, a compromised LiteLLM 1.107.0 release was published to PyPI on October 21, 2026, and distributed through official container images. The package added files executed during Python startup, so starting Python in an affected environment could be sufficient to run the payload; importing LiteLLM was not required. The code collected developer, cloud, browser, SSH, and other authentication material and transmitted it in encrypted form to an external endpoint. A Unix-oriented loader was designed to retrieve and execute additional Python code, but that activity was not confirmed.