Unknown attacker

Force in Play

Unidentified

LiteLLM published a malicious version 1.107.0 on October 21 and pulled it about two hours later. It carried a credential stealer that ran whenever Python started, even in programs that never imported the library, plus a backdoor that checked a GitHub repository for instructions.

Updated Oct 30