LiteLLM compromised: PyPI version 1.107.0 contains an infostealer and a remote access trojan

On October 21, 2026, version 1.107.0 of the open-source LLM agent LiteLLM was found on PyPI to have been injected with malicious code by attackers, and the official Docker image was also affected. The attackers used the data directive of maturin in pyproject.toml to package the cook/ directory created in the compromised build environment into the wheel; after installation, it runs automatically at Python startup through cook.pth, cook.py and sitecustomize.py. On first run, the infostealer steals browser-saved passwords, SSH private keys, AWS/Azure/GCP cloud credentials, CI/CD secrets, credentials for development tools such as Claude Code and Cursor, and the contents of the LiteLLM database, encrypts them with RSA-4096 and exfiltrates them; the remote access trojan fetches the C2 domain from a GitHub repository every hour and executes arbitrary code.