LiteLLM 1.107.0: when model gateway logs become a credential store

On October 21, 2026, a malicious build of LiteLLM 1.107.0 was published to PyPI, Docker Hub, and GHCR, containing a credential stealer and a remote code loader. LiteLLM says the attacker used the GitHub CLI OAuth tokens of three engineers to drive the release pipeline, and suspects that an internal deployment exposed to the public internet logged the request and response bodies of Claude Code sessions, leaving developer GitHub credentials unrelated to model access in the gateway logs. The malicious wheel adds cook.pth, cook.py, and sitecustomize.py, which can execute when any Python process starts; the stealer uses Prisma to export LiteLLM's credential table and model table when DATABASE_URL is set. Wiz says the stolen AWS role credentials were used to enumerate Bedrock models after about 4.5 hours.