Contained LiteLLM Incident

The most likely path is that the October 21 malicious release remains contained after PyPI and Docker Hub removals, token rotation, and workflow cleanup. Socket’s discovery of earlier malicious workflows extends the intrusion timeline but does not necessarily prove broader package compromise.

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.