LiteLLM 1.107.0 trojanizado no PyPI e em imagens Docker: infostealer e backdoor RCE via hooks de inicialização do Python
The LiteLLM release 1.107.0 (a widely used open source LLM proxy) was trojanized on PyPI on 21 October 2026 and carries a credential stealer plus a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) drop three extra files in site-packages, two of which run whenever any Python process starts, even one that never impor…