LiteLLM 1.107.0 PyPI Wheels Delivered Privcollect Stealer via Stolen GitHub CLI OAuth Tokens

The malicious release used three compromised GitHub accounts to trigger and approve a project-releaser workflow after OAuth tokens were stolen; the attacker then published eight specific wheels plus the source tarball containing tampered pyproject.toml. StepSecurity and Socket telemetry showed the payload harvesting cloud tokens, LiteLLM proxy configs, browser SQLite files, and AI JSON keys before exfiltrating gzipped archives to litellm.dev/healthcheck and polling github.com/letters9813/domain.txt hourly for secondary commands.

This incident repeats the exact cook.pth technique observed in the March TeamPCP supply-chain campaign against the same package, indicating the threat actor retained or re-acquired workflow access rather than discovering a novel vector. Official statements from LiteLLM cite only token revocation and org-member reduction, yet provide no evidence that PyPI maintainer keys or the release pipeline itself were audited for persistence.

Downstream AI workloads that pin LiteLLM without digest verification now face credential exposure across multiple cloud providers; the same pattern has appeared in other model-proxy libraries, raising the probability of coordinated follow-on attacks against dependency graphs that feed production inference endpoints.