Developer systems and AI services may have executed malware after installing LiteLLM 1.107.0. All seven PyPI wheel files were compromised, and affected images also reached container registries. The payload used Python startup hooks, allowing an unrelated Python command to trigger credential theft. PyPI removed the release, but that action does not clean infected systems or invalidate stolen secrets.
Why It Matters
The malware searched for browser data, SSH keys, cloud credentials, repository tokens and authentication files used by AI tools. A separate startup path could download more code on Linux and macOS, although that capability was not active during one analysis. For leaders: this is a credential incident, not simply a bad dependency. For defenders: isolate affected systems, preserve logs and rotate accessible secrets from a clean device. The larger lesson is that a brief package compromise can create persistent access elsewhere.
What Defenders Should Do
Rebuild affected environments from trusted sources and revoke every credential that LiteLLM 1.107.0 could access.