CriticalAPT
LiteLLM 1.107.0: From Startup Hooks to Credential Theft
ThreatMon·Source published ·1 min read
What happened?
Blog October 28, 2026 Stealer & Malware LiteLLM 1.107.0: From Startup Hooks to Credential Theft On October 21, 2026, a compromised build of LiteLLM (v1.107.0) was pushed to PyPI and official container registries. The malicious package drops files that hook directly into the Python interpreter’s startup routine. Because of this, the payload doesn’t wait for an explicit import litellm statement; simply running any Python command inside an affected environment is enough to trigger it.