LiteLLM 1.107.0 on PyPI ships a credential stealer that runs in every Python process

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

The LiteLLM 1.107.0 release on PyPI carries a credential stealer and a remote code execution backdoor hidden in all seven wheels. A single added line in the build config copies a cook/ folder into site-packages, where cook.pth and sitecustomize.py execute on every Python startup — even without importing litellm. The stealer harvests SSH keys, cloud and CI/CD secrets, browser passwords, and AI tool tokens, then beacons hourly to an attacker-controlled GitHub file. The upstream GitHub source is clean.