The litellm Python package versions 1.82.7, 1.82.8, and 1.107.0 distributed via PyPI contain malicious code injected during build or upload. This code includes a credential stealer that collects a wide range of sensitive data such as browser passwords, cloud credentials, SSH keys, and developer tool configurations, encrypts it, and exfiltrates it to an attacker-controlled server. Additionally, a backdoor is installed that fetches and executes remote code periodically, enabling remote code execution. Versions 1.106.2 and 1.107.0 release candidates are not affected. Any environment with version 1.107.0 installed should be considered compromised and credentials rotated.