LiteLLM 1.107.0 credential stealer: how to check yourself and what needs to be replaced

On October 21, 2026, litellm==1.107.0 on PyPI had a credential stealer implanted in all binary wheel files, and the Docker images tagged v1.107.0 were also infected; tags such as latest pointed to the infected image for about three hours; the version was uploaded at 11:39 UTC and removed from PyPI at 13:23, and 1.106.x and below are clean versions. According to StepSecurity's analysis, the stealer writes cook.pth, cook.py and sitecustomize.py into site-packages, runs on every Python startup without needing to import litellm, steals SSH and cloud keys, .env, environment variables and AI tool tokens, and if DATABASE_URL is set, also dumps the proxy database containing vendor API keys, encrypts it and sends it to litellm.dev.