Developer releases scanner to check LiteLLM 1.107.0 compromise

After LiteLLM's v1.107.0 release was compromised on PyPI, Docker Hub and GHCR, a developer published litellm-check, which inspects files and metadata without running Python to avoid triggering the implant. The tool's 13 rules come from the official incident post, and a sibling scanner checks code for DeepSeek components.

• LiteLLM 1.107.0 was compromised on Oct 21, 2026, until 13:23 UTC on PyPI
• The scanner never executes Python or pip inside the scanned environment
• Its 13 rules (LL-001–LL-013) derive solely from the official incident post
• A demo project yields 16 findings: 10 critical, 4 high and 2 info