LiteLLM 1.107.0 Shipped a Credential Stealer in All Seven Wheels
The compromised LiteLLM 1.107.0 wheels ran a credential stealer at every Python startup; 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean.
cook.pth is 12 bytes: one line, import cook. Python executes it at interpreter start, so no process had to import litellm for the payload to fire. All seven 1.107.0 wheels — Linux, macOS, Windows — dropped it, cook.py and sitecustomize.py into site-packages. PyPI has since removed the release; 1.106.2 and both release candidates are clean.
cook.py (22,252 bytes) collects SSH keys, cloud credentials, CI/CD secrets, browser passwords and the provider keys in a LiteLLM proxy database, encrypts them and posts to www.litellm[.]dev. sitecustomize.py (25,509 bytes) adds an hourly daemon that reads a server address from a GitHub file and runs fetched code. One maturin line in the sdist, data = "cook", is the only visible change.
What I keep turning over: the wheels match BerriAI’s normal release pipeline output, which makes the version pin the cheap check. Skip this if every Python process is a throwaway container with no credentials mounted. Otherwise picture the 3 a.m. CI runner with an admin cloud role and a .netrc in $HOME. Run pip freeze everywhere; a 1.107.0 hit means rotate, not reinstall.