LiteLLM 1.107.0 tampered with: Python startup hook steals cloud, AI, and agent credentials

litellm==1.107.0, released on October 21, 2026, was built from a source revision containing a credential stealer and remote code loader; PyPI subsequently quarantined that version, with the previous version being 1.106.2. The malicious change occurred only at the packaging layer: a line data = "cook" was added to the Maturin configuration in pyproject.toml, installing cook.pth, cook.py, and sitecustomize.py into site-packages, so that any Python startup in that environment triggers the payload. The collector contains 16 modules, reads cloud credentials and instance metadata, SSH/GPG/TLS private keys, browser passwords, login credentials for AI tools such as Claude, Codex, Gemini, Cursor, and Copilot, and queries the credential table and model configuration table in the LiteLLM proxy database, then encrypts and uploads them to www.litellm.dev/healthcheck.