LiteLLM 1.107.0 on PyPI compromised, carrying a credential stealer and code loader

LiteLLM 1.107.0 was published to PyPI as a malicious version on October 21; all seven wheels planted cook.pth, cook.py and sitecustomize.py in the site-packages root directory, causing a credential stealer to run as soon as Python started. PyPI quarantined the version within two hours, and the maintainers removed the malicious Docker image of the same version at 14:32 UTC, while the package had been downloaded more than 92 million times over the past month. The attacker added data = "cook" to the maturin configuration in pyproject.toml, packing the cook directory into the wheel, and rolled the version number back from 1.108.0 in the tag to 1.107.0; ten commits were submitted under the impersonating name Berri-AI, similar to the real organization name BerriAI, and were created via the GitHub web interface, thus carrying the Verified badge.