LiteLLM 1.107.0 Wheels Carried Credential-Stealing Malware
By @sharedot · · 6 pages
- Programming
- Security
- Open Source
- Supply Chain
Hackers compromised LiteLLM's release pipeline on October 21, pushing info-stealer malware in every PyPI wheel and Docker image for version 1.107.0.
A 92-Million-Download SDK Got a Poisoned Release
LiteLLM, the open-source Python SDK and AI gateway used by NVIDIA, Netflix, AT&T and Okta, says its release pipeline was compromised on October 21.
A threat actor pushed version 1.107.0 to PyPI and the Docker registry, and per the maintainer's post-mortem the version contained compiled malware that steals credentials and loads remote-code-execution tools.
Every one of the seven PyPI wheels was affected, live from 11:39:51 to 13:23 UTC, along with Docker Hub tags v1.107.0, latest, main-latest and main-stable. Enterprise customers running the private build were not impacted.
Why It Surprised: The Malware Ran Before Your Code Did
According to BleepingComputer, the attacker did not touch the LiteLLM application code and instead modified only the installation package, dropping three malicious files — cook.pth, cook.py and sitecustomize.py — into Python's library directory.
Endor Labs notes that this executes the payload before the application every time Python launches in the environment, and Socket researchers explained that even running Python or pip to investigate an affected installation triggered the malware.
Multiple application security companies detected the attack within six minutes of publishing.
What Was Stolen and Where It Went
BleepingComputer reports the malware targeted cloud and deployment credentials (AWS, Azure, Google Cloud, Kubernetes, Docker), AI development tools' authentication files and LiteLLM's stored provider credentials, developer secrets including Git, GitHub, npm, PyPI and CI/CD credentials, .env files, SSH, GPG and TLS keys, browser data, and environment variables.
Stolen data was encrypted with an AES-256-CBC key wrapped in an RSA-4096 key and uploaded to litellm[.]dev/healthcheck, with a detached loader checking a GitHub-hosted pointer every hour.
Stakes, Recovery and a Familiar Adversary
Rescana's analysis places this October incident in context of a March 2026 compromise in which the TeamPCP group used stolen GitHub CLI OAuth tokens and a poisoned Trivy dependency to publish malicious versions 1.82.7 and 1.82.8, harvesting over 50 categories of secrets.
The recommended recovery version is now 1.106.2; BleepingComputer advises stopping affected deployments, inspecting environments without launching Python, isolating and rebuilding infected systems, and rotating all exposed secrets immediately, since removing the package directory alone may leave startup files or an active loader behind.