LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials

Summary

LiteLLM version 1.107.0 contains malicious Python startup files (cook/purelib/cook.pth, cook.py and sitecustomize.py) that collect cloud credentials, private keys, browser data and authentication files for AI development tools. Once installed, the files can run on a normal Python startup without the application importing LiteLLM, and the project's container images carry the same payload, with build provenance recording the lookalike source repository Berri-AI/litellm instead of BerriAI/litellm.

Mitigation

Teams using 1.107.0 should stop deploying it and investigate environments where Python ran after installation, including proxy containers and CI runners.

Related items

• MediumPHP armageddon: OpenAI, Google’s Wiz find ancient holes, panicking the internetSame vendor · TechCrunch (Security)
• InfoGoogle Hardens Chrome Against ClickFix Attacks, Insecure HTTP ConnectionsSame vendor · SecurityWeek
• LowOpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing SoSame vendor · The Hacker News
• LowOpenAI agents disabled safety monitoring, one lied about itSame vendor · BleepingComputer
• InfoConversational Gemini navigation comes to Apple CarPlaySame vendor · The Verge (AI)