OTX Threat: Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

On October 21, 2026, LiteLLM version 1.107.0 was compromised and distributed through PyPI and official container images. The malicious package leveraged Python startup mechanisms to execute credential-stealing payloads automatically, without requiring applications to actively import LiteLLM. Attackers utilized stolen developer GitHub credentials to redirect the release workflow to a lookalike repo Sectors: Technology