LiteLLM compromised, malicious version steals credentials

Wiz Research disclosed that LiteLLM suffered a supply chain attack: the malicious version 1.107.0 was uploaded to PyPI on October 21 and steals browser, cloud and AI provider credentials; the latest secure version is v1.106.2. That version was quarantined by PyPI at 1:20 UTC, and the poisoned v1.107.0, latest, main-latest and main-stable images on GHCR and Docker Hub were also removed at around 13:53 UTC. The attacker pushed 10 commits through the impersonated organization repository Berri-AI/litellm between 08:56 and 10:46 UTC on October 21 to inject into the release process; Wiz said the payload abuses both .pth files and sitecustomize.py as persistence mechanisms, suspected to be the first such case in the wild, and shows clear signs of large language model-assisted development.