LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

LiteLLM's Python package version 1.107.0 was compromised in a supply chain attack that injected a credential stealer and backdoor, leading to its removal from PyPI and Docker registries. The attack exploited stolen GitHub CLI OAuth tokens from three engineers to publish the malicious release. The malware targeted cloud credentials, private keys, browser data, and AI tool authentication files.