Thursday, October 22, 2026 · 1 of 5

1. LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor

   Published through stolen maintainer tokens for about two hours. Check installs from the window and rotate secrets.

   Oct 21SecurityOpen Source