LiteLLM 1.107.0 trojanized on PyPI and Docker via leaked master key and stolen GitHub tokens: infostealer and RCE backdoor

Linha do tempo

1. theregister.com ↗ · pub. 26/10/2026 17:30 · coletado 26/10 18:00

   LiteLLM supply chain attack via unrevoked exposed master key poisoned PyPI release 1.107.0 with infostealer and RAT

   ler a análise desta fonte ocultar

   LiteLLM traced last week's supply chain attack to a master key accidentally committed to the public LiteLLM-Labs/lite-harness GitHub repository on May 27. The commit was removed, but the key was never revoked. A poisoned version (1.107.0) of the open source AI gateway was published to PyPI and its container registries, carrying an infostealer and a remote access trojan. It was available for under two hours but was downloaded about 49,000 times, according to Wiz. Anyone who installed and ran 1.107.0 should assume all credentials accessible to the system were stolen.

   Technical Details

   • On October 10, the threat actor used the exposed master key to access the LiteLLM Agent Platform and extracted a GitHub CLI OAuth token (per LiteLLM's postmortem). The key belonged to an open source tool used internally to orchestrate AI agents.
   • GitHub CLI tokens are "post-2fa" and do not trigger GitHub sudo mode, so the token gave owner-level access to all repositories in the LiteLLM GitHub organization.
   • The actor pushed malicious commits to branches of internal repos, including workflows built to steal tokens and secrets available during CI. This yielded GitHub CLI OAuth tokens for two engineers with maintainer privileges, plus tokens for several other internal systems.
   • The actor's activity on those systems focused on finding and exfiltrating further keys, primarily upstream inference API tokens.
   • With stolen maintainer identities, repository changes and approvals appeared to come from legitimate engineers.
   • The infostealer targeted browser credentials and cookies (Chrome, Firefox, Edge, Safari), AWS credentials, GCP service account keys and application default credentials, Azure tokens, and API keys for OpenAI, Anthropic, Cohere and other LLM providers.

   Remediation

   • If 1.107.0 was installed and run, treat all credentials reachable from the host as compromised: investigate affected systems, change passwords and rotate exposed keys.
   • LiteLLM is revoking every token tied to every internal system and vendor platform.
   • Always revoke secrets that were committed publicly, even after the commit is deleted.
2. thehackernews.com ↗ · pub. 24/10/2026 08:03 · coletado 24/10 09:00

   Leaked LiteLLM Agent Platform master key enabled GitHub token theft and malicious LiteLLM 1.107.0 PyPI release

   ler a análise desta fonte ocultar

   LiteLLM disclosed that a master key for its LiteLLM Agent Platform, committed by mistake to the public LiteLLM-Labs/lite-harness repository on May 27, 2026, was never revoked. On October 10, 2026, an unknown attacker used it to extract an unscoped GitHub CLI OAuth token tied to the GitHub organization owner. The attacker then stole maintainer tokens through malicious workflows and, on October 21, hijacked the release pipeline to publish the trojanized LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR. Upwind researcher Lidor Machluf reported the attack, PyPI quarantined the release within about two hours of the report, and the Docker tags were repointed to clean images. The malicious package runs on Python startup, steals credentials and installs a backdoor.

   Technical Details

   • Initial access: the attacker (from 69.48.229[.]143) used the unrevoked master key to reach the Agent Platform and pull the GitHub CLI OAuth token, which gave owner-level access to all organization repositories.
   • Credential theft: on Oct 10 (10:11-10:12 p.m. UTC) the attacker pushed commits to throwaway branches (ci-tmp-a351cc, ci-tmp-4d8517) in BerriAI/litellm and BerriAI/litellm-auto. Each added .github/workflows/cache.yml (commit subject "ci: bump cache config", trigger on: [push]) and the branches were deleted within minutes (Socket). A second commit followed on Oct 12.
   • Secrets targeted: GitHub tokens, Linear, LiteLLM and Together AI keys, and a GitHub App ID and signing key. The Oct 12 run added Anthropic, OpenAI, AWS Bedrock, Tavily and GitGuardian keys, Playwright storage state, PostgreSQL credentials and Redis credentials. Data was sent to two webhook[.]site endpoints.
   • Release hijack: on Oct 21 (10:08-11:08 a.m. UTC) branch protection was overridden and the release source repointed to the lookalike Berri-AI/litellm. One stolen maintainer token triggered the release and another approved it. The two-engineer approval rule had been relaxed earlier that week for faster releases. Version 1.107.0 was published to PyPI at about 11:39 UTC, Docker Hub and GHCR images at 11:46, and production and staging run records were deleted at about 11:53.
   • Malicious package: files execute automatically when Python starts, even if LiteLLM is never imported. There are two paths: a credential stealer and a Unix backdoor that fetches and runs attacker code every hour. The stealer collects system information, SSH files, Git/GitLab credentials, environment variables, and tokens for npm, PyPI, pip, Yarn, Maven, Gradle, Composer, RubyGems and Cargo, plus browser and cloud credentials. It POSTs the data to litellm[.]dev/healthcheck, a domain registered on October 13, 2026.
   • Persistence: the startup files sit outside the LiteLLM application directory, so removing only the application files can leave the malicious components behind (Microsoft Security Research).
   • Revised assessment: LiteLLM's initial hypothesis that the OAuth tokens were stolen from internal deployment logs was ruled out.

   Remediation

   • LiteLLM is revoking every token tied to internal systems and vendor platforms.
   • Defenders should identify any environment that installed LiteLLM 1.107.0 and remove the startup components as well as the application files.
   • Rotate all credentials, API keys and tokens exposed on affected hosts, and block litellm[.]dev and the listed IP.
   • Always revoke leaked keys, scope CI/CD tokens to least privilege, and keep strict release-approval controls.
3. gbhackers.com ↗ · pub. 24/10/2026 06:00 · coletado 24/10 07:00

   LiteLLM GitHub org breached 11 days before PyPI supply chain attack; CI secrets stolen via rogue workflows

   ler a análise desta fonte ocultar

   Socket found that attackers had access to the BerriAI/litellm GitHub organization and ran credential-stealing GitHub Actions workflows on October 10 and 12, 2026. That is eleven days before the October 21 supply chain attack that distributed malicious litellm==1.107.0 packages. LiteLLM traced initial access to an Agent Platform master key committed publicly on May 27 and never revoked. The attacker used it to obtain an unrestricted GitHub CLI OAuth token belonging to an organization owner, then stole further credentials and hijacked the release pipeline. Socket cautions that October 10 is only the earliest activity it can substantiate, so the full intrusion window and scope remain uncertain.

   Technical Details

   • Both workflows used the commit message ci: bump cache config and introduced .github/workflows/cache.yml. The attacker pushed it to temporary branches (ci-tmp-a351cc, ci-tmp-4d8517) created from legitimate commits, let GitHub Actions run it, then deleted the branches without merging into main.
   • The October 10 workflow had one job targeting six secrets, including GH_TOKEN, a GitHub App private key, and LiteLLM, Linear and Together AI credentials. It wrote them to /tmp/c.env, base64-encoded them to /tmp/c.b64, and POSTed them with curl to webhook.site. A trailing || true suppressed errors, so the job reported success even if exfiltration failed.
   • The October 12 variant expanded to six jobs, five bound to GitHub environments. Across both, 20 distinct secret names were referenced, covering OpenAI, Anthropic, AWS Bedrock, GitGuardian, PostgreSQL, Redis and Linear browser session material.
   • Audit-log token hashes linked the GH_TOKEN stolen from BerriAI/litellm to approval of the malicious production release. Another stolen maintainer token was used to delete release workflow records.
   • On October 21 the attacker bypassed branch protections with owner privileges and redirected the release pipeline to the lookalike Berri-AI/litellm repository. The pipeline then signed and published seven malicious PyPI wheels and compromised container images.

   Remediation

   • LiteLLM locked its registries, removed all but one trusted GitHub organization member, and began revoking credentials across internal systems and vendors.
   • Defenders using LiteLLM should avoid litellm==1.107.0 and rotate any secrets exposed to affected CI environments.
   • Review GitHub audit logs and environment deployment records for short-lived branches and unexpected workflow runs, since deleted branches hide this activity from routine reviews.
4. securityweek.com ↗ · pub. 23/10/2026 05:10 · coletado 23/10 07:00

   LiteLLM 1.107.0 poisoned on PyPI and Docker in supply chain attack via stolen GitHub CLI tokens

   ler a análise desta fonte ocultar

   On October 21, attackers published a malicious LiteLLM version 1.107.0 to PyPI and Docker Hub. LiteLLM is a widely used open source proxy for routing requests across LLM providers. The packages were live for about three hours and were downloaded an estimated 49,000+ times before being removed or repointed to clean artifacts. They install an information stealer and RAT. Wiz observed attackers abusing stolen credentials about 4.5 hours after exfiltration, including querying Amazon Bedrock models with stolen AWS keys, which suggests LLMjacking. LiteLLM says enterprise customers pulling from its private repository were not affected.

   Technical Details

   • Initial compromise: Per LiteLLM's investigation, attackers obtained GitHub CLI OAuth tokens from an unexpected, innocuously named user account in an internal LiteLLM deployment exposed to the public internet. The tokens were likely leaked by Claude Code, which in specific circumstances embeds them in a response body that may be written to LiteLLM logs; the attackers likely retrieved them from those logs. How they reached the internal deployment and moved laterally is still unknown. They held three sets of developer GitHub CLI credentials.
   • Pipeline abuse: The attackers disabled branch protections, merged a change pointing the releaser to a different source repository, and ran a compromised GitHub workflow pointing to a lookalike repository (Berri-AI/litellm, posing as the legitimate BerriAI/litellm). They then signed and published the poisoned artifacts.
   • Payload: Likely built with AI assistance, it extracts three files into the site-packages root so they execute whenever a Python interpreter runs. The stealer harvests system information, browser credentials and cookies, developer credentials, environment variables, cloud secrets (AWS, GCP, Azure), AI tool API keys (Anthropic, GitHub Copilot, OpenAI and others), SSH private keys, shell history and GPG keys. Data is encrypted and sent to litellm[.]dev.
   • RAT: It beacons regularly to the attackers' C&C server and, per StepSecurity, checks a GitHub dead drop every hour and runs whatever Python the attacker serves.

   Remediation

   • Remove LiteLLM 1.107.0 immediately; the latest clean version is 1.106.2.
   • Rotate all credentials and secrets that were exposed on affected systems (cloud, AI API keys, SSH, GitHub, GPG).
   • Sweep systems for the malware and check for unauthorized use of cloud AI services such as Bedrock.
5. bleepingcomputer.com ↗ · pub. 22/10/2026 16:12 · coletado 22/10 17:00

   LiteLLM release pipeline compromised: PyPI 1.107.0 and Docker images distribute credential-stealing malware

   ler a análise desta fonte ocultar

   On October 21, attackers compromised the release pipeline of LiteLLM, an open-source Python SDK and AI gateway with about 92 million monthly PyPI downloads. They published malicious version 1.107.0 to PyPI, Docker Hub and GHCR. The payload steals cloud, AI, developer and browser credentials and loads remote-code execution tools. All seven wheels for 1.107.0 were affected on Windows, Linux and macOS. The maintainer says customers on the private enterprise offering were not impacted. Security vendors detected the attack within six minutes of publication. The project was previously breached in March by TeamPCP via the compromised Trivy scanner in its CI/CD pipeline.

   Technical Details

   • The attacker did not modify LiteLLM application code. Only the installation package was altered, to drop cook.pth, cook.py and sitecustomize.py into the Python library directory.
   • Python executes .pth lines and imports sitecustomize at startup, so the payload runs every time Python or pip is launched in the environment, including during investigation.
   • Targeted data: AWS, Azure, GCP, Kubernetes and Docker secrets; AI tool credentials and LiteLLM provider keys; Git, GitHub, npm, PyPI and CI/CD credentials; .env files; SSH, GPG and TLS keys; browser logins, cookies and autofill data; environment variables, shell histories and system/network information.
   • Stolen data is encrypted with AES-256-CBC, with the key wrapped in RSA-4096, and uploaded to litellm[.]dev/healthcheck.
   • sitecustomize.py starts a detached loader that polls a GitHub-hosted pointer hourly and downloads Python code from an external server for execution.
   • Exposure windows (UTC): PyPI 11:39:51-13:23; Docker Hub tags v1.107.0, latest, main-latest and main-stable 11:46:56-14:20; GHCR same tags from 11:46:56 until removed by 13:51.
   • Detection by Socket and Endor Labs, among other application security vendors.

   Remediation

   • Stop affected deployments and inspect environments without launching the Python interpreter.
   • Isolate infected systems and rebuild from clean backups; deleting the LiteLLM package directory alone may leave startup files or an active loader.
   • Rotate all exposed secrets immediately.
   • Roll back to LiteLLM 1.106.2, the last clean release.
   • Check for the three malicious files and the compromised image digests.
6. thehackernews.com ↗ · pub. 22/10/2026 05:28 · coletado 22/10 08:00

   LiteLLM release pipeline compromised: malicious v1.107.0 on PyPI and Docker delivers credential stealer and RAT

   ler a análise desta fonte ocultar

   On October 21, 2026, attackers compromised the LiteLLM release pipeline and published malicious version 1.107.0 to PyPI, Docker Hub and GHCR. The package carried a credential stealer ("privcollect") and a backdoor that runs remote code every hour, effectively a RAT. LiteLLM suspects the attacker obtained developer GitHub CLI OAuth tokens from logs of an internal, publicly exposed LiteLLM deployment, where Claude Code responses had embedded the tokens. Wiz observed stolen AWS credentials validated about 4.5 hours after exfiltration, consistent with LLMjacking. Socket found no evidence linking this incident to the March 2026 TeamPCP attack, despite the shared use of a .pth file.

   Technical Details

   • Exposure window: pip installs of unpinned versions between 11:39 and 13:23 UTC; Docker tags v1.107.0, latest, main-latest and main-stable (Docker Hub and GHCR) between 11:46 and 14:20 UTC.
   • Stealer: cook.pth imports cook.py, which deobfuscates itself and runs "privcollect". It collects system, browser, developer, cloud and AI tool secrets and exfiltrates them by HTTP POST to litellm[.]dev/healthcheck.
   • Backdoor: sitecustomize.py (Linux and macOS only) forks a daemon that holds /tmp/remote_code_loader.lock. Every hour it fetches the C2 domain from a GitHub dead drop (github[.]com/letters9813, pythonclient-test/main/domain.txt) and then downloads and executes a Python payload from https://{domain}/codepy. Wiz reports the file held only test values before GitHub took it down around 13:30 UTC. Wiz also describes the combined .pth and sitecustomize.py technique as the first documented in the wild.
   • Intrusion chain:
     • On October 19, LiteLLM temporarily expanded release permissions for two engineers.
     • The attacker held three sets of developer GitHub CLI credentials, one able to run workflows.
     • A token of a GitHub organization owner was used to disable branch protections and force-push changes.
     • The workflow was pointed at the lookalike repository "Berri-AI/litellm" instead of "BerriAI/litellm", so the poisoned artifacts were signed and published.
   • Initial access: how the internal deployment became public, and how the attacker got in, is unknown. LiteLLM theorizes a recently patched vulnerability.
   • Post-exfiltration abuse (Wiz): AWS instance role credentials from CI runners and Kubernetes nodes were checked with sts:GetCallerIdentity, then bedrock:ListFoundationModels and ListModels. In a few environments the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and ran general discovery.
   • Attribution: Socket notes the RSA public keys, exfiltration implementation and backdoor behavior differ from the March attack. No link is established, and the role of credentials stolen in March is unverified.

   Remediation

   • Remove LiteLLM 1.107.0, isolate affected hosts and hunt for the malicious artifacts (cook.pth, cook.py, sitecustomize.py, the lock file).
   • Block the exfiltration domain, investigate execution of /codepy, and rotate all reachable credentials.
   • Rebuild affected environments. Pin versions and verify the exact wheel before it reaches a build.
7. gbhackers.com ↗ · pub. 22/10/2026 02:36 · coletado 22/10 04:00

   LiteLLM 1.107.0 PyPI wheels and container images compromised with credential-stealing malware

   ler a análise desta fonte ocultar

   LiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images. On October 21, 2026, Socket reported that malicious Python startup hooks run even when an application never imports LiteLLM, exposing cloud credentials, developer secrets and AI tool authentication files. Socket flagged seven malicious wheels about seven minutes after publication, covering macOS, Linux and Windows. LiteLLM gets about 23 million weekly downloads, so the release sat close to sensitive production and development credentials.

   Technical Details

   • Container build provenance listed Berri-AI/litellm as the source instead of the legitimate BerriAI/litellm. The private BerriAI/project-releaser workflow showed a source-owner override selecting the hyphenated organization. The evidence does not show how the override was authorized, whether an account or token was compromised, or whether that workflow published the wheels.
   • Build changes added data = "cook" to the Maturin configuration and copied the malicious directory into Docker build stages.
   • Container tags v1.107.0, latest, main-latest and main-stable all resolved to the same image index, which widened exposure beyond pinned deployments.
   • The wheels install cook.pth, cook.py and sitecustomize.py into Python's library directory. The startup hook runs during normal interpreter initialization, so starting Python or pip in an affected environment re-triggers the malware.
   • The decoded privcollect payload has 16 collection modules targeting AWS, Azure, Google Cloud, Kubernetes, SSH keys, browser databases, environment variables and developer configuration files. AI-specific targets include Codex, Claude, Gemini and Cursor.
   • A database module tries to read saved credentials and model settings from LiteLLM tables. There is no evidence of successful theft from individual deployments.
   • Collected JSON is encrypted with AES-256-CBC, with the key wrapped using RSA-4096-OAEP, and uploaded to a deceptive /healthcheck endpoint.
   • sitecustomize.py launches a detached loader that reads a GitHub-hosted pointer and can run downloaded Python files without signature or hash verification. The pointer was empty in one observation, which blocked that stage but not the collector. The loader retries hourly, which does not confirm hourly exfiltration.

   Remediation

   • Block the release and inspect image digests, including the latest, main-latest and main-stable tags.
   • Isolate environments where Python ran after installation, and preserve evidence with trusted tooling rather than the affected interpreter.
   • Rebuild from reviewed artifacts and rotate potentially exposed credentials from a clean system. Removing LiteLLM alone neither reverses exposure nor stops an existing loader.
   • Maintainers should validate repository identities, release permissions and published artifacts against approved sources.
8. theregister.com ↗ · pub. 21/10/2026 15:22 · coletado 21/10 16:00

   LiteLLM PyPI and Docker supply chain compromise (v1.107.0) delivers credential stealer and RAT

   ler a análise desta fonte ocultar

   Unknown attackers compromised the release process of LiteLLM, the open source AI gateway developed by BerriAI, and distributed malicious version 1.107.0 through PyPI and Docker registries (Docker Hub and GHCR). The package carries an infostealer targeting cloud and AI credentials and a RAT that can execute arbitrary code. PyPI quarantined the version within hours and the Docker image litellm/litellm:1.107.0 was removed, but anyone who ran it should assume their secrets are stolen. LiteLLM gets about 23 million weekly downloads, and the scale of this incident is not yet known. An earlier LiteLLM compromise in March reportedly exposed more than 2,500 organizations and 434,000 CI/CD pipelines (per CloudSEK). BerriAI did not respond to The Register.

   Technical Details

   • The malicious version was uploaded at 11:39 UTC. According to Wiz researchers, the payload came from malicious commits to github.com/Berri-AI/litellm, a hyphenated lookalike of the legitimate BerriAI organization. This repo was used to inject three malicious files into the release pipeline.
   • cook.pth makes Python automatically run cook.py on every interpreter invocation, with no user action.
   • cook.py is the infostealer, with 16 modules. It harvests browser credentials and cookies (Chrome, Firefox, Edge, Safari), AWS credentials (~/.aws/, environment variables, EC2/ECS IMDS), GCP service account keys and application default credentials, Azure CLI tokens, and API keys for OpenAI, Anthropic, Cohere and other LLM providers. It also takes SSH private keys, GPG keys and shell history.
   • sitecustomize.py is the RAT. It also runs at interpreter startup and spawns a background daemon that polls attacker infrastructure hourly for commands.
   • Stolen data is encrypted with AES-256-CBC, the key is wrapped with RSA-4096, and the blob is sent by HTTP POST to http://www[.]litellm[.]dev/healthcheck.
   • Host indicators: /tmp/.pc_once_* means exfiltration has fired; /tmp/remote_code_loader.lock means the C2 daemon ran or is still running (Aikido Security).
   • Affected images also include those pulled via the latest, main-latest and main-stable tags.

   Remediation

   • Stop deploying 1.107.0. The most recent safe version is v1.106.2.
   • Investigate every environment where Python ran after installation, including proxy containers and CI runners.
   • Check for the two /tmp artifacts above.
   • Treat all secrets on affected hosts as compromised and rotate them: LLM provider API keys, cloud credentials, SSH/GPG keys and database connection strings.
   • Follow the threat-hunting and mitigation guidance published by Aikido, Wiz and Socket.
9. thehackernews.com ↗ · pub. 21/10/2026 15:01 · coletado 21/10 16:00

   LiteLLM 1.107.0 PyPI and Docker Supply Chain Compromise Delivers privcollect Credential Stealer and Backdoor

   ler a análise desta fonte ocultar

   The widely used LiteLLM Python package was compromised in a software supply chain attack. Malicious version 1.107.0 was published via PyPI wheels and Docker images, delivering a credential stealer and a backdoor, per reports from SafeDep, Socket, StepSecurity and Upwind. LiteLLM says the release was pushed through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. The initial token theft vector is still unknown. The package has been quarantined on PyPI and the malicious Docker images removed. The same .pth execution behavior was seen in the earlier TeamPCP-linked LiteLLM compromise in March.

   Technical Details

   • Affected artifacts: litellm-1.107.0 wheels for macOS (x86_64, arm64), manylinux_2_28 (x86_64, aarch64), musllinux_1_2 (x86_64, aarch64) and Windows (win_amd64), plus the sdist litellm-1.107.0.tar.gz (no payload files, but a tampered pyproject.toml).
   • Attackers used one user's account to trigger the project-releaser run and another's to approve it.
   • Execution occurs at interpreter start, before LiteLLM is imported, via the path file cook.pth containing import cook.
   • Payload 1, a stealer calling itself privcollect, harvests cloud tokens, developer accounts and private keys, AI tooling credential JSON files, Chromium and Firefox browser data, and environment variables. It also targets LiteLLM proxy saved credentials and model configuration.
   • Stolen data is packed into a GZIP-compressed TAR and sent by HTTP POST to litellm[.]dev/healthcheck.
   • Payload 2 forks a background daemon that checks a GitHub dead drop hourly: it reads domain.txt in github[.]com/letters9813, reruns the stealer if a domain is present, then fetches <domain>/codepy via HTTP GET and executes the response. The repository now returns 404.

   Remediation

   • Revoke and replace all credentials exposed on systems that installed 1.107.0, working from a clean environment.
   • Pin LiteLLM to version 1.106.2 by digest.
   • LiteLLM revoked all involved tokens, removed all but one unaffected user from its GitHub organization, and removed trusted links to its GitHub organization from the public registries. It cannot yet rule out further access to the affected accounts.
10. aikido.dev ↗ · pub. 21/10/2026 10:05 · coletado 21/10 12:01

    LiteLLM 1.107.0 PyPI wheels and Docker image trojanized with infostealer and persistent Python RAT

    ler a análise desta fonte ocultar

    On October 21, 2026, LiteLLM version 1.107.0, a widely used open source LLM proxy, was found to be compromised. An attacker injected malicious code into the compiled Python wheels published on PyPI, and the official Docker image litellm/litellm:1.107.0 is also affected. The package carries an infostealer that exfiltrates credentials and secrets on first run, and a RAT that lets the attacker execute arbitrary Python on infected hosts every hour. PyPI has quarantined the version, but the Docker image was still live on Docker Hub at the time of reporting. Anyone who installed this version should assume credentials are compromised.

    Technical Details

    • The attacker abused the [tool.maturin] data = "cook" directive in pyproject.toml to bundle a cook/ directory, which exists only in the compromised build environment and not in the source repo, into every wheel.
    • Three files are dropped into site-packages: cook.pth (12 bytes, import cook, runs at every interpreter start), cook.py (the infostealer, a single obfuscated line that decompresses and executes a 61,000-byte payload), and sitecustomize.py (the RAT).
    • The infostealer collects system information, Chromium and Firefox credentials and history, SSH keys, shell history, AWS/Azure/GCP credentials (including instance metadata endpoints), Docker and Kubernetes secrets, CI/CD secrets (GitLab runner, Jenkins, Vault), AI developer tool configs (Claude Code, Cursor, Copilot, Windsurf, Gemini CLI and others), Git/npm/PyPI credentials, GPG/TLS keys, and all environment variables (including /proc/<pid>/environ on Linux). It also dumps LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable from the LiteLLM database.
    • Data is encrypted with a hardcoded RSA-4096 public key and sent by HTTP POST to http://www[.]litellm[.]dev/healthcheck. The sentinel file /tmp/.pc_once_72129118c59f5636c0bb limits it to one run per machine.
    • The RAT forks a daemon that takes the lock /tmp/remote_code_loader.lock. Every hour it fetches the current C2 domain from raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt, then downloads and execs Python from http://{domain}/codepy with no sandboxing.
    • Network indicators: HTTP POST with User-Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0) and header X-Token: XWiA8gZNa7NcX2XRoAEb.

    Remediation

    • Check for /tmp/.pc_once_* (exfiltration already fired) and /tmp/remote_code_loader.lock (C2 daemon ran or is running) on any host that installed litellm==1.107.0 or ran litellm/litellm:1.107.0, including the latest, main-latest and main-stable tags.
    • Treat all credentials, API keys, SSH/GPG/TLS keys, cloud and CI/CD secrets reachable from affected hosts as compromised and rotate them.
    • Remove the affected version and image, hunt for cook.pth, cook.py and sitecustomize.py in site-packages, and block the listed domains and the GitHub C2 lookup path.
    • Rebuild affected hosts or containers from known-good sources.
11. wiz.io ↗ · pub. 21/10/2026 10:44 · coletado 21/10 12:01

    LiteLLM PyPI package and Docker images trojanized (v1.107.0) with credential stealer and persistence hooks

    ler a análise desta fonte ocultar

    On October 21, a malicious LiteLLM version (1.107.0) was uploaded to PyPI. Trojanized Docker images on GHCR and Docker Hub (tags v1.107.0, latest, main-latest, main-stable) were also published. The payload was injected through malicious commits in github.com/Berri-AI/litellm, a hyphenated lookalike of the legitimate BerriAI organization, which fed the release pipeline. The package installs a stealer, internally named privcollect, that harvests browser, cloud, developer and AI provider secrets and exfiltrates them to the attacker-controlled domain www.litellm[.]dev. The PyPI version was quarantined and the Docker tags removed at about 13:53 UTC. The last known safe version is v1.106.2.

    Technical Details

    • Installation drops cook.pth, cook.py and sitecustomize.py into the site-packages root, so the code runs whenever a Python interpreter starts. The .pth file imports cook, which deobfuscates itself, runs the stealer and writes a marker file at /tmp/.pc_once_72129118c59f5636c0bb. The marker write fails on Windows.
    • privcollect has 16 modules. It collects Chrome, Firefox, Edge and Safari credentials and cookies, AWS credentials (~/.aws/, environment variables, EC2/ECS IMDS), GCP service account keys and ADC, Azure CLI token cache, API keys for OpenAI, Anthropic, Cohere and other LLM providers, SSH and GPG keys, and shell history.
    • On LiteLLM Proxy hosts it queries PostgreSQL directly with SELECT * FROM "LiteLLM_CredentialsTable" LIMIT 500 to dump upstream provider keys.
    • Data is encrypted with AES-256-CBC (key wrapped with RSA-4096) and sent by HTTP POST to www.litellm[.]dev/healthcheck with a hardcoded X-Token header and an Internet Explorer 7 user-agent.
    • sitecustomize.py runs on Linux and macOS only. It fetches domain.txt from a GitHub dead drop (letters9813/pythonclient-test) and, if populated, downloads and runs a second-stage Python script from http://<domain>/codepy. The file was never populated at the time of analysis, and the repo was taken down.
    • Between 08:56 and 10:46 UTC the attacker pushed 10 commits using the email [email protected]. The first nine were GitHub-signed, added the persistence files, bumped the version and added data = "cook" to pyproject.toml so the malware is bundled into the wheel. A final unsigned commit under [email protected] added COPY cook ./cook to the Dockerfiles. The commits remain visible via the parent repo through fork object sharing (compare a8113b0d...20535d8f).

    Remediation

    • Identify any host or container that installed or pulled LiteLLM 1.107.0 or the affected Docker tags, and pin to v1.106.2.
    • Search for cook.pth, cook.py, sitecustomize.py and the /tmp/.pc_once_* marker, and hunt for traffic to litellm[.]dev.
    • Treat all secrets on affected systems as compromised and rotate them: cloud credentials, LLM provider API keys, keys in the LiteLLM_CredentialsTable, SSH/GPG keys and browser sessions.
    • Rebuild affected images and environments from known-good sources.
12. safedep.io ↗ · pub. 20/10/2026 21:00 · coletado 21/10 12:00 primeiro registro

    Compromised LiteLLM 1.107.0 on PyPI Drops Credential Stealer and Remote Code Backdoor via Python Startup Hooks

    ler a análise desta fonte ocultar

    The LiteLLM 1.107.0 release on PyPI was trojanized with a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install three extra files in site-packages, and two of them run whenever any Python process starts, even one that never imports litellm. The malicious code is not in the upstream GitHub source, and PyPI has since removed the release. SafeDep assesses with moderate to high confidence that BerriAI's private release pipeline built the wheels from attacker-modified git source. The exact cause (compromised maintainer or bot credential, private branch or mirror, or the build reference) can only be confirmed from BerriAI's pipeline logs. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean, as are the pinned companion packages litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78.

    Technical Details

    • Injection: the sdist pyproject.toml has one extra line in the maturin section, data = "cook". It copies a cook/ folder (absent from the sdist) into litellm-1.107.0.data/purelib/, and pip installs it into site-packages. No public commit in BerriAI/litellm contains it.
    • Tag mismatch: tag v1.107.0 (commit 66c8f5b) declares version 1.108.0. The sdist matches a later main commit (a8113b0) plus edited files. The version was reset to 1.107.0 and the companion pins were set to the rc2 values, so a dependency diff against rc2 shows nothing unusual.
    • Build provenance: the wheels were built with maturin 1.9.4, like the legitimate releases, with separate native builds on macOS, Linux and Windows. SafeDep checked 539 public GitHub Actions runs and found none that built the release, and PyPI has no provenance attestations for these versions.
    • Payload 1, cook.pth / cook.py: cook.pth contains import cook, so the stealer runs in every Python process (applications, pip, IDE language servers, CI jobs). The zlib/base64-packed code collects SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and history, shell history, GPG keys, TLS private keys, cloud metadata and the LLM provider keys in a LiteLLM proxy database. Results are encrypted with AES-256-CBC, the key is wrapped with RSA-OAEP (RSA-4096), and the tar.gz is POSTed to www.litellm[.]dev/healthcheck with an X-Token header. A marker file limits collection to once per host.
    • Payload 2, sitecustomize.py: it takes a lock file, forks and detaches a daemon, and every hour reads a domain from domain.txt in the attacker's GitHub repository, re-runs an embedded stealer copy with no once-per-host marker, and downloads and exec()s code from http://<domain>/codepy.
    • Takedown: at 13:40 UTC on 2026-10-21 the GitHub account letters9813 and its repository returned 404, so the backdoor currently finds no server address. Hosts whose daemon ran earlier could have received second-stage code. SafeDep could not recover the server address.

    Remediation

    • Check for litellm==1.107.0 in environments, lockfiles, containers and CI caches. Treat any host that installed it as compromised.
    • Look for cook.pth, cook.py and sitecustomize.py in site-packages, /tmp/.pc_once_72129118c59f5636c0bb, /tmp/remote_code_loader.lock, and traffic to litellm[.]dev.
    • Rotate all credentials reachable from affected hosts: SSH keys, cloud and CI/CD secrets, AI tool tokens, LLM provider keys and browser-stored passwords.
    • Because second-stage code may have run, consider rebuilding affected hosts. Pin known-good versions (1.106.2 or 1.107.0rc2).