Hackers hid a key-stealer inside LiteLLM — it fired every time Python started

Version 1.107.0 of LiteLLM — the open-source proxy library developers use to route calls across dozens of LLM providers, at about 23 million weekly downloads — shipped on PyPI with two malicious payloads baked into all seven wheels. One is a credential stealer researchers call 'privcollect' that harvests cloud tokens, SSH keys, browser passwords and AI-tool credentials; the other is a backdoor that forks a background daemon, checks a GitHub dead-drop every hour, and runs whatever Python the attacker serves. Both fire automatically when the Python interpreter starts, even if you never import LiteLLM.

LiteLLM says the attacker used stolen GitHub CLI OAuth tokens from three of its own engineers' accounts — one to trigger the release run, another to approve it — and that it has removed all but one unaffected user from its GitHub org. PyPI quarantined 1.107.0 and the poisoned Docker tags, including latest, were pulled; anyone who installed it is being told to rotate every credential that touched the machine. This is LiteLLM's second supply-chain compromise in 2026.