LiteLLM Says a Poisoned Release Was Built to Steal Credentials. Check Before You Run pip

LiteLLM, a Python package that sits between apps and the big model companies, says a poisoned version of itself, 1.107.0, was built to steal credentials, and that it was live for about two hours on October 21, 2026. Wiz says that version was downloaded about 49,000 times and was designed to run whenever Python starts: the attack put a .pth file and a sitecustomize.py into Python's own folders, so nothing had to import LiteLLM. LiteLLM's first report said it had observed situations in which Claude Code will embed a user's GitHub CLI OAuth token into a response body, and it suspected tokens taken from its logs were used to push the release.