{
    "author": null,
    "date_published": null,
    "dek": null,
    "direction": "ltr",
    "domain": "safedep.io",
    "excerpt": "LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.",
    "lead_image_url": "https://safedep.io/images/litellm-pypi-compromise-credential-stealer-backdoor-banner.jpg",
    "next_page_url": null,
    "rendered_pages": 1,
    "title": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor",
    "total_pages": 1,
    "url": "https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor",
    "word_count": 1199
}