On October 21, 2026, someone published a malicious litellm==1.107.0 to PyPI. It's the second time the package has been compromised this year, and it's unrelated to the March incident. PyPI has pulled it, and 1.106.2 is safe. If you build with LLMs, there's a decent chance LiteLLM is somewhere on your machine even if you never installed it yourself. A lot of agents and proxies use it to talk to Claude, GPT and the rest through one interface. That's what makes this one nasty: the payload goes...