Compromised LiteLLM Release Puts AI Credentials at Supply-Chain Risk

Reports describe malicious code in LiteLLM 1.107.0 on PyPI that runs at startup, steals credentials, and includes a remote-code loader; the package was removed. Downstream exposure and incident scope are unclear, so affected users should investigate execution and rotate reachable secrets while reviewing build provenance and isolation.