GoKawiilLiteLLM's PyPI package and Docker images hit by credential-stealing malware
The LiteLLM project's release pipeline was compromised on October 21, allowing attackers to publish a malicious version 1.107.0 to PyPI and Docker Hub containing compiled malware that steals credentials, secrets and environment variables. Affected artifacts included all seven PyPI wheels and several Docker Hub and GHCR image tags, live for roughly two to three hours before removal. The maintainer confirmed enterprise customers running the private version were not impacted, and said attackers modified only the installation package rather than the application code.