REPORTED DEVELOPMENT
LiteLLM confirmed that public version 1.107.0 was distributed with malicious code capable of stealing credentials and loading remote-code-execution tools. Compromised PyPI packages were available from 11:39 to 13:23 UTC; several Docker images were also affected.
Official GitHub source did not contain the malicious files present in distributed packages. LiteLLM says the incident is contained and investigation continues. Independent Wiz research confirms mechanisms targeting cloud credentials and AI-provider keys.
WHY IT MATTERS TO THE MARKET
Dependency verification must distinguish source code from the executable artifact actually distributed.