🚨 SlowMist TI Alert 🚨 LiteLLM has been compromised again in a supply chain attack. The malicious release [email protected] affects PyPI packages and Docker images, including floating tags such as latest and main-stable. The injected malware executes automatically during Python startup, stealing cloud credentials, AI API keys, SSH private keys, and other sensitive data. It also enables remote code execution. Affected releases have been removed or replaced. Users should avoid version 1.107.0, rebuild compromised environments from clean images, and rotate potentially exposed credentials. Pinning to 1.106.2 is recommended. You can also visit https://www.misteye.io/ to check for free whether the npm packages, pip packages, domains, or IPs you use are safe. As always, stay vigilant! https://enterprise.misteye.io/threat-intelligence/SM-2026-397543