pypi

A malicious LiteLLM release stole credentials on install

LiteLLM 1.107.0 on PyPI shipped a credential stealer and an hourly backdoor that ran at every Python startup; the upstream GitHub source never had them.