LiteLLM

Global – October 29, 2026 -- A malicious version of LiteLLM, version 1.107.0, was published to PyPI on October 29, 2026. It bundles a credential-stealing infostealer with a remote access trojan (RAT), according to OX Security. It is the second hijacking of the AI gateway this year, and PyPI has since quarantined the release.

Malware hides in the wheel package, not the source repository

The attacker injected the code only into the wheel package, so a review of the repository or the clean source would show nothing wrong. Stolen data goes to litellm[.]dev, a domain the attacker bought that can pass for a legitimate LiteLLM address. In March, versions 1.82.7 and 1.82.8 were compromised in the TeamPCP campaign, but this attack used different tooling and infrastructure.