litellm 1.107.0 poisoned on PyPI: backdoored wheels release a credential stealer and an hourly remote code loader

litellm 1.107.0, published to PyPI on October 21, 2026, had malicious code implanted in all 7 wheels, and the official LiteLLM Docker image carried the same payload. The payload runs automatically on every Python startup via .pth and sitecustomize, without needing to import litellm: the privcollect stealer collects browser passwords, SSH and GPG keys, cloud credentials, configurations of more than 20 AI coding tools, and provider API keys in the LiteLLM proxy database, encrypts them, and sends them back to the impersonated domain www.litellm.dev; another payload spawns a daemon that every hour reads an address from an attacker-controlled GitHub repository and executes the delivered Python code. The infected version was built from the impersonated repository Berri-AI/litellm, and the attacker layered ten commits on top of the clean v1.107.0 git tag.