EN PT-BR
← Voltar ao feed
critical technology software ai

LiteLLM 1.107.0 on PyPI and Docker images compromised with credential stealer and persistent RCE backdoor

1 fonte(s) · 1 atualização(ões) · publicado 20/10/2026 21:00 · coletado há 1 hora

The LiteLLM 1.107.0 release on PyPI was compromised and ships a credential stealer and a remote code execution backdoor in all seven wheels (Linux, macOS, Windows). The implants run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them. LiteLLM confirmed the compromise in an incident report. PyPI removed the release by 13:23 UTC on 2026-10-21. Docker images v1.107.0, latest, main-latest and main-stable on Docker Hub and GHCR also carried the malicious code between 11:46 and 14:20 UTC.

Detalhes técnicos

  • Affected/clean versions: 1.107.0 is malicious. 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean, as are litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78.
  • Injection: the sdist pyproject.toml has an extra data = "cook" line in the maturin section. It copies a cook/ folder into the wheel's purelib, which pip installs into site-packages. The sdist omits the cook/ folder, and no public commit in BerriAI/litellm contains it.
  • Files added: cook.pth (import cook), cook.py (22252 bytes, zlib/base64 packed stealer) and sitecustomize.py (25509 bytes, loader/backdoor with embedded stealer).
  • Stealer (cook.py): runs in a daemon thread through the .pth import hook in every Python process. It collects sysinfo, netinfo, browser passwords and history, SSH keys, shell history, cloud credentials, dev secrets, container credentials, CI/CD secrets, AI devtool tokens, env vars, the LiteLLM proxy database (LLM provider keys), cloud metadata, GPG keys and TLS private keys. Data is encrypted with AES-256-CBC, the key is wrapped with RSA-OAEP (RSA-4096), and the tar.gz is POSTed to www.litellm[.]dev/healthcheck with header X-Token. The marker /tmp/.pc_once_72129118c59f5636c0bb limits collection to once per host, and PRIVCOLLECT_ACTIVE=1 prevents a second run in the same process tree.
  • Backdoor (sitecustomize.py): takes a lock on /tmp/remote_code_loader.lock, then forks and detaches with setsid. Every 3600 seconds it reads domain.txt from the attacker's GitHub repo letters9813/pythonclient-test, reruns the stealer (no once-per-host marker), and downloads and exec()s http:///codepy.
  • Publishing path: per LiteLLM, the attacker held GitHub CLI credentials of three developers, believed to be taken from logs of an internal LiteLLM deployment exposed to the internet. An org owner's token was used to bypass branch protection and point the private release workflow at the lookalike repo Berri-AI/litellm. A second developer's credential passed the approval gate, so the official pipeline built, signed and published the artifacts.
  • Takedown: at 13:40 UTC the letters9813 account and repo returned 404, so the backdoor currently finds no server. Hosts that ran the daemon earlier could have run second-stage code. SafeDep could not recover the server address.

Remediação

The article points to LiteLLM's incident report for remediation steps. Anyone who installed litellm==1.107.0 or pulled the affected Docker tags should treat the host as compromised. Hosts should be checked for cook.pth, cook.py and sitecustomize.py in site-packages and for the /tmp marker and lock files. Exposed credentials and keys should be rotated.

Linha do tempo

  1. safedep.io ↗ · pub. 20/10/2026 21:00 · coletado 02/11 05:00 primeiro registro

    LiteLLM 1.107.0 on PyPI and Docker images compromised with credential stealer and persistent RCE backdoor

    ler a análise desta fonte

    The LiteLLM 1.107.0 release on PyPI was compromised and ships a credential stealer and a remote code execution backdoor in all seven wheels (Linux, macOS, Windows). The implants run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them. LiteLLM confirmed the compromise in an incident report. PyPI removed the release by 13:23 UTC on 2026-10-21. Docker images v1.107.0, latest, main-latest and main-stable on Docker Hub and GHCR also carried the malicious code between 11:46 and 14:20 UTC.

    Technical Details

    • Affected/clean versions: 1.107.0 is malicious. 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean, as are litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78.
    • Injection: the sdist pyproject.toml has an extra data = "cook" line in the maturin section. It copies a cook/ folder into the wheel's purelib, which pip installs into site-packages. The sdist omits the cook/ folder, and no public commit in BerriAI/litellm contains it.
    • Files added: cook.pth (import cook), cook.py (22252 bytes, zlib/base64 packed stealer) and sitecustomize.py (25509 bytes, loader/backdoor with embedded stealer).
    • Stealer (cook.py): runs in a daemon thread through the .pth import hook in every Python process. It collects sysinfo, netinfo, browser passwords and history, SSH keys, shell history, cloud credentials, dev secrets, container credentials, CI/CD secrets, AI devtool tokens, env vars, the LiteLLM proxy database (LLM provider keys), cloud metadata, GPG keys and TLS private keys. Data is encrypted with AES-256-CBC, the key is wrapped with RSA-OAEP (RSA-4096), and the tar.gz is POSTed to www.litellm[.]dev/healthcheck with header X-Token. The marker /tmp/.pc_once_72129118c59f5636c0bb limits collection to once per host, and PRIVCOLLECT_ACTIVE=1 prevents a second run in the same process tree.
    • Backdoor (sitecustomize.py): takes a lock on /tmp/remote_code_loader.lock, then forks and detaches with setsid. Every 3600 seconds it reads domain.txt from the attacker's GitHub repo letters9813/pythonclient-test, reruns the stealer (no once-per-host marker), and downloads and exec()s http:///codepy.
    • Publishing path: per LiteLLM, the attacker held GitHub CLI credentials of three developers, believed to be taken from logs of an internal LiteLLM deployment exposed to the internet. An org owner's token was used to bypass branch protection and point the private release workflow at the lookalike repo Berri-AI/litellm. A second developer's credential passed the approval gate, so the official pipeline built, signed and published the artifacts.
    • Takedown: at 13:40 UTC the letters9813 account and repo returned 404, so the backdoor currently finds no server. Hosts that ran the daemon earlier could have run second-stage code. SafeDep could not recover the server address.

    Remediation

    The article points to LiteLLM's incident report for remediation steps. Anyone who installed litellm==1.107.0 or pulled the affected Docker tags should treat the host as compromised. Hosts should be checked for cook.pth, cook.py and sitecustomize.py in site-packages and for the /tmp marker and lock files. Exposed credentials and keys should be rotated.