LiteLLM was compromised by attackers who injected malicious code, publishing malicious artifacts to PyPI, Docker Hub, and GHCR. The code included an information stealer targeting cloud credentials, passwords, and AI service credentials, along with a remote access trojan. LiteLLM has removed the malicious versions and issued remediation guidance.