/
← Voltar ao feed
critical technology software

LiteLLM release pipeline compromised: PyPI 1.107.0 and Docker images distribute credential-stealing malware

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 16:12 · coletado há 5 horas

On October 21, attackers compromised the release pipeline of LiteLLM, an open-source Python SDK and AI gateway with about 92 million monthly PyPI downloads. They published malicious version 1.107.0 to PyPI, Docker Hub and GHCR. The payload steals cloud, AI, developer and browser credentials and loads remote-code execution tools. All seven wheels for 1.107.0 were affected on Windows, Linux and macOS. The maintainer says customers on the private enterprise offering were not impacted. Security vendors detected the attack within six minutes of publication. The project was previously breached in March by TeamPCP via the compromised Trivy scanner in its CI/CD pipeline.

Detalhes técnicos

  • The attacker did not modify LiteLLM application code. Only the installation package was altered, to drop cook.pth, cook.py and sitecustomize.py into the Python library directory.
  • Python executes .pth lines and imports sitecustomize at startup, so the payload runs every time Python or pip is launched in the environment, including during investigation.
  • Targeted data: AWS, Azure, GCP, Kubernetes and Docker secrets; AI tool credentials and LiteLLM provider keys; Git, GitHub, npm, PyPI and CI/CD credentials; .env files; SSH, GPG and TLS keys; browser logins, cookies and autofill data; environment variables, shell histories and system/network information.
  • Stolen data is encrypted with AES-256-CBC, with the key wrapped in RSA-4096, and uploaded to litellm[.]dev/healthcheck.
  • sitecustomize.py starts a detached loader that polls a GitHub-hosted pointer hourly and downloads Python code from an external server for execution.
  • Exposure windows (UTC): PyPI 11:39:51-13:23; Docker Hub tags v1.107.0, latest, main-latest and main-stable 11:46:56-14:20; GHCR same tags from 11:46:56 until removed by 13:51.
  • Detection by Socket and Endor Labs, among other application security vendors.

Remediação

  • Stop affected deployments and inspect environments without launching the Python interpreter.
  • Isolate infected systems and rebuild from clean backups; deleting the LiteLLM package directory alone may leave startup files or an active loader.
  • Rotate all exposed secrets immediately.
  • Roll back to LiteLLM 1.106.2, the last clean release.
  • Check for the three malicious files and the compromised image digests.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 22/10/2026 16:12 · coletado 22/10 17:00 primeiro registro

    LiteLLM release pipeline compromised: PyPI 1.107.0 and Docker images distribute credential-stealing malware

    ler a análise desta fonte

    On October 21, attackers compromised the release pipeline of LiteLLM, an open-source Python SDK and AI gateway with about 92 million monthly PyPI downloads. They published malicious version 1.107.0 to PyPI, Docker Hub and GHCR. The payload steals cloud, AI, developer and browser credentials and loads remote-code execution tools. All seven wheels for 1.107.0 were affected on Windows, Linux and macOS. The maintainer says customers on the private enterprise offering were not impacted. Security vendors detected the attack within six minutes of publication. The project was previously breached in March by TeamPCP via the compromised Trivy scanner in its CI/CD pipeline.

    Technical Details

    • The attacker did not modify LiteLLM application code. Only the installation package was altered, to drop cook.pth, cook.py and sitecustomize.py into the Python library directory.
    • Python executes .pth lines and imports sitecustomize at startup, so the payload runs every time Python or pip is launched in the environment, including during investigation.
    • Targeted data: AWS, Azure, GCP, Kubernetes and Docker secrets; AI tool credentials and LiteLLM provider keys; Git, GitHub, npm, PyPI and CI/CD credentials; .env files; SSH, GPG and TLS keys; browser logins, cookies and autofill data; environment variables, shell histories and system/network information.
    • Stolen data is encrypted with AES-256-CBC, with the key wrapped in RSA-4096, and uploaded to litellm[.]dev/healthcheck.
    • sitecustomize.py starts a detached loader that polls a GitHub-hosted pointer hourly and downloads Python code from an external server for execution.
    • Exposure windows (UTC): PyPI 11:39:51-13:23; Docker Hub tags v1.107.0, latest, main-latest and main-stable 11:46:56-14:20; GHCR same tags from 11:46:56 until removed by 13:51.
    • Detection by Socket and Endor Labs, among other application security vendors.

    Remediation

    • Stop affected deployments and inspect environments without launching the Python interpreter.
    • Isolate infected systems and rebuild from clean backups; deleting the LiteLLM package directory alone may leave startup files or an active loader.
    • Rotate all exposed secrets immediately.
    • Roll back to LiteLLM 1.106.2, the last clean release.
    • Check for the three malicious files and the compromised image digests.