Poisoned LiteLLM 1.107.0 stole cloud and AI keys on every Python start
On 21 October 2026 a poisoned LiteLLM 1.107.0 release went out through the project's own signed release pipeline. For about two hours, every Python start on an affected machine could leak cloud credentials, AI tool tokens and the LLM provider keys stored in a LiteLLM proxy.