LiteLLM, the open source gateway thousands of teams use to route calls across OpenAI, Anthropic and other model providers, was compromised at the packaging layer. Version 1.107.0 on PyPI shipped a credential stealer and a remote code execution backdoor inside all seven wheels for Linux, macOS and Windows. The malicious files landed in site-packages as cook.pth, cook.py and sitecustomize.py. Two of them execute every time any Python process starts on the host, even a process that never imports litellm. The upstream GitHub source is clean, so the implant existed only in the published artefacts.
SafeDep, which documented the incident, says cook.py collected SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and the provider keys stored in a LiteLLM proxy database, then shipped them to a lookalike domain at www.litellm.dev. A sitecustomize daemon re-ran the stealer hourly and pulled fresh code from an attacker-controlled GitHub file. LiteLLM's incident report says the attacker held the GitHub CLI credentials of three developers, most likely scraped from logs of an internet-exposed internal deployment, then used an organisation owner token to bypass branch protection and point the private release workflow at a lookalike repository.
PyPI pulled the release by 13:23 UTC on 21 October, and the affected Docker images were removed between 11:46 and 14:20 UTC. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean. Founders running LiteLLM should pin dependencies, check hosts for those three site-packages files, and treat every key that touched an affected machine as compromised and due for rotation.