The LiteLLM remote access trojan spawns a background daemon that polls attacker infrastructure every hour for commands or checks a GitHub dead drop repository.

From the articleLiteLLM supply chain attack hoovers up passwords and secretsAlso in LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor, LiteLLM supply-chain attack targets credentials and installs a RAT | Межа