litellm 1.107.0 on PyPI is compromised: its wheels install a .pth file that runs a credential stealer at every Python interpreter startup, collecting SSH keys, cloud and CI/CD secrets, environment variables and LiteLLM database credentials, along with a sitecustomize.py loader that periodically fetches and executes remote Python code. PyPI has removed the version, but any environment that installed it remains compromised and its credentials should be rotated. The litellm Docker images for v1.107.0, including the latest, main-latest and main-stable tags, carry the same payload.