LiteLLM 1.107.0 on PyPI and Docker shipped credential-stealing malware

LiteLLM's release pipeline was compromised in the early hours of October 21, and version 1.107.0 was pushed to both PyPI and the Docker registry. The PyPI wheels were live from 11:39 to 13:23 UTC, and the Docker tags from 11:46 to 14:20 UTC. The project says the payload steals credentials and loads remote-code execution tools, and that the enterprise private release was not affected. The maintainers report that attackers obtained three developer GitHub credentials to carry out the push. Security firms describing the same build say the stealer targets SSH keys, cloud credentials, CI/CD secrets and LLM provider keys. Teams that run LiteLLM as a proxy often keep those keys in one database, which makes a single compromised host expensive. For anyone building an AI company, this is a supply chain attack on the routing layer many apps depend on. Pin to a known good version, check whether the 1.107.0 image or wheel ever ran in your environment, and treat any reachable key as exposed until it is rotated.