A Twelve Byte Hook Ran Before Your Code Did

LiteLLM 1.107.0 reached PyPI on 21 October carrying a working credential stealer in three files that any Python start would run. A scanner caught it seven minutes later. The wheels stayed downloadable for another 96 minutes.

• cook.pth is twelve bytes and holds one import statement. Python processes it at interpreter startup, so the payload fires without your application importing litellm.
• Operators who ran pip show or a version check inside the affected virtualenv executed it again. Reading the wheel as a zip is safe.
• The stealer queries LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable directly, where a proxy deployment keeps every upstream provider key.
• It also collects AWS instance metadata, Google service accounts, SSH keys, and the auth files for Codex, Claude, Gemini and Cursor.
• The release workflow was driven by three stolen GitHub CLI tokens, and the build read source from Berri-AI/litellm, one hyphen off the real repository.
• Wiz saw harvested AWS role credentials listing Bedrock models four and a half hours after the exfiltration. It is the second compromise of this project in seven months.

Wiz names 1.106.2 as the last clean release. Rotation is the fix, not the upgrade. Full analysis here.