LiteLLM 1.107.0 on PyPI was implanted with a credential stealer and backdoor

The LiteLLM 1.107.0 release package on PyPI was implanted with a credential stealer and a remote code execution backdoor; wheels for seven platforms all write three files into site-packages, which are loaded when any Python process starts, even without importing litellm. The stealer collects SSH keys, cloud credentials, CI/CD secrets, browser passwords and AI tool tokens, encrypts them and uploads them to www.litellm[.]dev; the backdoor reads a server address hourly from the attacker's GitHub file, downloads and executes code. LiteLLM's incident report says the attacker held the GitHub CLI credentials of three developers, bypassed branch protection and pointed the release process to a lookalike repository Berri-AI/litellm, then used a second developer's credentials to pass the approval gate. GitHub account letters9813 returned 404 at 13:40 UTC, after which the backdoor could no longer find the server address.