LITELLM 1.107.0 WAS CLEAN IN GIT AND CLEAN IN THE SDIST. THE WHEEL WAS THE MALWARE.
LiteLLM 1.107.0 shipped a credential stealer to PyPI and to its official Docker images. The git tag was clean, the source archive had no payload files, and a diff against the release candidate showed nothing unusual. The wheel was the malware, and that is the part worth fixing.