LiteLLM 1.107.0 shipped a credential stealer through Python startup hooks
A compromised LiteLLM 1.107.0 release published to PyPI on October 21, 2026 and distributed through official container images installed Python startup hooks that executed a credential stealer without requiring the applic…