What happened
On Oct 23 Microsoft published analysis of a compromised LiteLLM 1.107.0 release (PyPI + official container images) that deployed malicious Python startup files (cook.pth/cook.py, sitecustomize.py) to steal credentials and load remote code; payload executes on any Python startup in the affected environment, not just active gateway users.
Why it matters
LiteLLM is a widely-deployed LLM gateway sitting on model API keys, DB credentials and tenant config; exposure reaches developer workstations, CI/CD agents and containers, and the recovery guidance (rotate credentials, don't start Python to test) is easy to get wrong.
Applicability
Teams running LiteLLM — or any Python environment where the package was installed — should treat the environment as compromised, rotate/validate exposed credentials, and follow Microsoft's Defender detections, hunting queries and recovery guidance.