PyPI has removed the release. SafeDep says versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean; the pinned companion packages litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78 are also reported clean.
The seven affected wheels for Linux, macOS, and Windows install three additional files into site-packages. A .pth file imports a credential-stealing module whenever Python starts, including processes that do not import LiteLLM. The reported collection targets include SSH keys, cloud credentials, CI/CD secrets, AI-tool tokens, browser passwords, and LLM provider keys stored in a LiteLLM proxy database.
A second component starts a background daemon. According to SafeDep, it checks a server address from a GitHub file hourly, reruns the stealer, and can download and execute code. The report says the upstream public GitHub source does not contain the implanted files and that the wheels appear to have been built through the normal release process.
The source does not establish how the release pipeline was compromised. It assesses an attacker-modified source used by a private BerriAI release pipeline as more consistent with the evidence than a stolen PyPI token, but says only pipeline logs can confirm the cause.