The litellm supply chain attack: how MCP servers got compromised and how to check if you're affected

litellm 1.82.7 and 1.82.8 were compromised on PyPI via a .pth file. MCP clients auto-download deps via uvx without pins. Here's how to check and clean up.