Malicious LiteLLM version 1.107.0 installs a remote access trojan via sitecustomize.py that executes at Python startup to run arbitrary code.

From the articleLiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and BackdoorAlso in LiteLLM supply-chain attack targets credentials and installs a RAT | Межа, LiteLLM supply chain attack hoovers up passwords and secrets