LiteLLM 1.107.0 on PyPI shipped a credential stealer that reads coding-agent tokens and MCP configs

SafeDep reports that all seven wheels of LiteLLM 1.107.0 install three extra files in site-packages, and that two of them run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them, and PyPI has since removed the release. SafeDep lists 1.106.2, 1.107.0rc1 and 1.107.0rc2 as clean.

The stealer collects SSH keys, cloud and CI/CD credentials, and the LLM provider keys stored in a LiteLLM proxy database. Its target list also names configuration and tokens for Claude Code, Claude Desktop, Cursor, Windsurf, Copilot, Codex and Gemini CLI, plus MCP config files. A second file starts a background daemon that, every hour, reads a server address from a GitHub file and runs whatever code that server returns. SafeDep says the GitHub account was deleted about two hours after the release, so the backdoor now has no address to fetch, but hosts that ran it earlier could have received second-stage code, and it could not recover the server.

The tag v1.107.0 points at a commit whose pyproject.toml says version 1.108.0, and the published source matches a later commit plus one injected line, data = "cook". SafeDep found no public GitHub Actions run that built the release. It assesses, with moderate to high confidence, that BerriAI's private release pipeline built the wheels from attacker-modified source, and says only BerriAI's pipeline logs can confirm the cause. Hashes and host indicators are in the post.

Why it matters: Any machine or CI job that installed 1.107.0 should be treated as having exposed everything on that list, including agent tokens and MCP configs. The mismatch between tag and contents is also the kind of thing an unattended agent installing dependencies will not notice, so release-to-source checks belong in the harness, not in a human's attention.