LiteLLM compromised in supply chain attack with credential stealer

The popular LiteLLM Python package was compromised in a software supply chain attack that delivered a credential stealer and a backdoor. Version 1.107.0, distributed via PyPI wheels and Docker images, has been quarantined on PyPI, with SafeDep, Socket, StepSecurity and Upwind reporting the incident.

• LiteLLM 1.107.0 affected via PyPI wheels and Docker images
• Malicious payload steals credentials and installs a backdoor
• The package has been quarantined on Python Package Index
• SafeDep, Socket, StepSecurity and Upwind reported the compromise