# LiteLLM Shipped Malware on October 21 — 49K Downloads Before Anyone Noticed > Source: > Published: 2026-10-30 03:13:15+00:00 On October 21, 2026, someone with maintainer access to LiteLLM pushed a poisoned release — version 1.107.0 — to PyPI and Docker Hub. The package contained a professional-grade credential stealer and an hourly remote code execution loader. It was live on PyPI for one hour and forty-four minutes. In that window, 49,000 developers downloaded it. If you run any Python environment with LiteLLM installed, treat it as compromised until proven otherwise. LiteLLM is the open-source AI gateway most teams use to route requests across providers — OpenAI, Anthropic, Gemini, and dozens of others. It sees 23 million downloads a week […] The post