The LiteLLM PyPI compromise is the clearest recent example that…

The LiteLLM PyPI compromise is the clearest recent example that model-normalizing SDKs are now a supply-chain choke point. If you let a gateway library hold provider API keys or tenant data, a malicious release can harvest creds from any Python process and call home. Teams should separate routing from secret custody: a routing proxy can accept short-lived, purpose-limited tokens or sign requests on behalf of callers without storing long-term provider keys inside the SDK. Treat the gateway as a router, not the credential owner.