LiteLLM loses game of Trivy pursuit, gets compromised

Two compromised LiteLLM Python packages were removed from PyPI after a supply‑chain attack injected credential‑stealing malware into the project via a polluted CI/CD pipeline. The malicious code was distributed in released package versions, exposing users who installed those releases to credential theft and other post‑install malicious activity. PyPI takedown is in place; affected users should assume compromise of any environments that installed the malicious versions, rotate credentials and secrets, audit build pipelines and CI artifacts, pin/verifiably source dependencies, and scan for the I