Bedrock adds structured outputs for Claude; LiteLLM 1.107.0 shipped credential stealer

AWS now enforces JSON schema compliance at token generation for all Claude models on Bedrock via constrained decoding, configured in output_config.format. The litellm 1.107.0 package on PyPI contained malicious wheels during a roughly two-hour window on October 21, 2026, exfiltrating SSH keys, cloud credentials and LLM API keys.

• Bedrock accepts a JSON Schema Draft 2020-12 subset via InvokeModel and Messages API
• First request per schema incurs grammar compilation, cached for about 24 hours
• litellm 1.107.0 was compromised on October 21 between 11:39 and 13:23 UTC
• cook.pth, cook.py and sitecustomize.py execute on every Python process start