LiteLLM 1.107.0 was implanted with an information stealer and RAT

On October 21, 2026, the maliciously implanted LiteLLM 1.107.0 was published to PyPI, and PyPI has quarantined that version. The malicious code was injected only into the wheel package, making anomalies difficult to find when reviewing the source repository; as long as the package is installed, every Python startup triggers it even if the project does not use LiteLLM. The malware has both information-stealing and RAT functionality, stealing LLM provider API keys, cloud credentials, environment variables, and credentials in the LiteLLM proxy database; targets include AWS and Azure keys, GitHub credentials, and data from AI tools such as Claude Code, GitHub Copilot, and Cursor, and the stolen content is sent to the attacker-purchased impersonation domain litellm[.]dev. This is the second time LiteLLM has been hijacked this year; the 1.82.7 and 1.82.8 versions in March this year were compromised in the TeamPCP campaign.