Search — “cook.py”

Attackers used a leaked, unrevoked LiteLLM Agent Platform master key to steal GitHub OAuth tokens, harvest CI secrets via throwaway-branch workflows exfiltrating to webhook.site, and repoint the release pipeline to a lookalike repo, publishing malicious LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR on 2026-10-21. The wheel drops cook.pth/cook.py/sitecustomize.py into site-packages so any Python start runs the PRIVCOLLECT credential collector, which encrypts loot with OpenSSL in .pc_e_ staging dirs and POSTs to www.litellm.dev/healthcheck; a Unix loader polls a GitHub dead-drop for second-stage code (not confirmed executed). Microsoft observed collector activity on Windows and macOS endpoints. Hunt for Python spawning systeminfo/ipconfig/openssl, connections to litellm.dev, the startup files outside the litellm directory, and /tmp marker/lock files.