Bollcoin, October 22 - According to SlowMist, LiteLLM has suffered another supply chain attack, with the malicious version litellm@1.107.0 affecting PyPI packages and Docker images, including floating tags such as latest and main-stable. The injected malicious code executes automatically when Python starts, stealing sensitive data such as cloud credentials, AI API keys, and SSH private keys, and supports remote code execution. The affected versions have been removed or replaced. SlowMist advises users to avoid version 1.107.0, rebuild affected environments from clean images, rotate potentially leaked credentials, and pin versions to 1.106.2.