LiteLLM 1.107.0 carried a credential stealer; Railway and Zeabur report leaks of customer secrets
LiteLLM says its release pipeline was compromised and litellm 1.107.0 on PyPI and Docker carried credential-stealing malware; it advises pinning 1.106.2 and rotating keys, including provider keys stored in the proxy. Railway and Zeabur, as reported, had customer environment variables read by attackers seeking AI service keys. The post's wider list of 27 incidents was not checked by us.
