LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials

LiteLLM version 1.107.0 on PyPI and Docker was compromised in a supply chain attack, delivering a credential stealer via Python startup hooks (cook.pth, cook.py, sitecustomize.py). The malware collects cloud credentials (AWS, Azure, GCP), AI provider keys, SSH/GPG keys, browser data, and developer secrets. A lookalike GitHub repository 'Berri-AI/litellm' (vs legitimate 'BerriAI/litellm') was recorded in container build provenance, indicating the release workflow was hijacked. Seven wheel files across macOS, Linux, and Windows were affected, as well as multiple Docker/GHCR container images including those tagged 'latest'. Stolen data is encrypted with AES-256-CBC and RSA-4096 and exfiltrated to hxxp://www[.]litellm[.]dev/healthcheck. A remote Python code loader is controlled via a GitHub file at letters9813/pythonclient-test. Socket's AI scanner detected the malicious package seven minutes after publication. Users are advised to immediately stop using 1.107.0, revoke exposed credentials, and roll back to 1.106.2.