LiteLLM 1.107.0 was malware. A 5-minute check for AI developers, and the one-line setting that would have skipped it
A malicious litellm==1.107.0 was published to PyPI on October 21, 2026, roughly an hour after the legitimate 1.106.2 release, and was removed by PyPI the same day. The payload drops a .pth file and sitecustomize.py into …