OTX Threat: LiteLLM supply chain compromise

On October 21, 2026, attackers compromised litellm version 1.107.0, a popular Python proxy library for LLM providers with approximately 23 million weekly downloads. The malicious release was available on PyPI and official Docker images for about two hours. Attackers used stolen GitHub CLI OAuth tokens from three engineers to launch a private release workflow against a malicious fork. The payload i