LiteLLM 1.107.0 trojanized on PyPI and Docker images via stolen GitHub tokens: infostealer and RCE backdoor through Python startup hooks

Linha do tempo

1. theregister.com ↗ · pub. 21/10/2026 15:22 · coletado 21/10 16:00

   LiteLLM PyPI and Docker supply chain compromise (v1.107.0) delivers credential stealer and RAT

   ler a análise desta fonte ocultar

   Unknown attackers compromised the release process of LiteLLM, the open source AI gateway developed by BerriAI, and distributed malicious version 1.107.0 through PyPI and Docker registries (Docker Hub and GHCR). The package carries an infostealer targeting cloud and AI credentials and a RAT that can execute arbitrary code. PyPI quarantined the version within hours and the Docker image litellm/litellm:1.107.0 was removed, but anyone who ran it should assume their secrets are stolen. LiteLLM gets about 23 million weekly downloads, and the scale of this incident is not yet known. An earlier LiteLLM compromise in March reportedly exposed more than 2,500 organizations and 434,000 CI/CD pipelines (per CloudSEK). BerriAI did not respond to The Register.

   Technical Details

   • The malicious version was uploaded at 11:39 UTC. According to Wiz researchers, the payload came from malicious commits to github.com/Berri-AI/litellm, a hyphenated lookalike of the legitimate BerriAI organization. This repo was used to inject three malicious files into the release pipeline.
   • cook.pth makes Python automatically run cook.py on every interpreter invocation, with no user action.
   • cook.py is the infostealer, with 16 modules. It harvests browser credentials and cookies (Chrome, Firefox, Edge, Safari), AWS credentials (~/.aws/, environment variables, EC2/ECS IMDS), GCP service account keys and application default credentials, Azure CLI tokens, and API keys for OpenAI, Anthropic, Cohere and other LLM providers. It also takes SSH private keys, GPG keys and shell history.
   • sitecustomize.py is the RAT. It also runs at interpreter startup and spawns a background daemon that polls attacker infrastructure hourly for commands.
   • Stolen data is encrypted with AES-256-CBC, the key is wrapped with RSA-4096, and the blob is sent by HTTP POST to http://www[.]litellm[.]dev/healthcheck.
   • Host indicators: /tmp/.pc_once_* means exfiltration has fired; /tmp/remote_code_loader.lock means the C2 daemon ran or is still running (Aikido Security).
   • Affected images also include those pulled via the latest, main-latest and main-stable tags.

   Remediation

   • Stop deploying 1.107.0. The most recent safe version is v1.106.2.
   • Investigate every environment where Python ran after installation, including proxy containers and CI runners.
   • Check for the two /tmp artifacts above.
   • Treat all secrets on affected hosts as compromised and rotate them: LLM provider API keys, cloud credentials, SSH/GPG keys and database connection strings.
   • Follow the threat-hunting and mitigation guidance published by Aikido, Wiz and Socket.
2. thehackernews.com ↗ · pub. 21/10/2026 15:01 · coletado 21/10 16:00

   LiteLLM 1.107.0 PyPI and Docker Supply Chain Compromise Delivers privcollect Credential Stealer and Backdoor

   ler a análise desta fonte ocultar

   The widely used LiteLLM Python package was compromised in a software supply chain attack. Malicious version 1.107.0 was published via PyPI wheels and Docker images, delivering a credential stealer and a backdoor, per reports from SafeDep, Socket, StepSecurity and Upwind. LiteLLM says the release was pushed through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. The initial token theft vector is still unknown. The package has been quarantined on PyPI and the malicious Docker images removed. The same .pth execution behavior was seen in the earlier TeamPCP-linked LiteLLM compromise in March.

   Technical Details

   • Affected artifacts: litellm-1.107.0 wheels for macOS (x86_64, arm64), manylinux_2_28 (x86_64, aarch64), musllinux_1_2 (x86_64, aarch64) and Windows (win_amd64), plus the sdist litellm-1.107.0.tar.gz (no payload files, but a tampered pyproject.toml).
   • Attackers used one user's account to trigger the project-releaser run and another's to approve it.
   • Execution occurs at interpreter start, before LiteLLM is imported, via the path file cook.pth containing import cook.
   • Payload 1, a stealer calling itself privcollect, harvests cloud tokens, developer accounts and private keys, AI tooling credential JSON files, Chromium and Firefox browser data, and environment variables. It also targets LiteLLM proxy saved credentials and model configuration.
   • Stolen data is packed into a GZIP-compressed TAR and sent by HTTP POST to litellm[.]dev/healthcheck.
   • Payload 2 forks a background daemon that checks a GitHub dead drop hourly: it reads domain.txt in github[.]com/letters9813, reruns the stealer if a domain is present, then fetches <domain>/codepy via HTTP GET and executes the response. The repository now returns 404.

   Remediation

   • Revoke and replace all credentials exposed on systems that installed 1.107.0, working from a clean environment.
   • Pin LiteLLM to version 1.106.2 by digest.
   • LiteLLM revoked all involved tokens, removed all but one unaffected user from its GitHub organization, and removed trusted links to its GitHub organization from the public registries. It cannot yet rule out further access to the affected accounts.
3. wiz.io ↗ · pub. 21/10/2026 10:44 · coletado 21/10 12:01

   LiteLLM PyPI package and Docker images trojanized (v1.107.0) with credential stealer and persistence hooks

   ler a análise desta fonte ocultar

   On October 21, a malicious LiteLLM version (1.107.0) was uploaded to PyPI. Trojanized Docker images on GHCR and Docker Hub (tags v1.107.0, latest, main-latest, main-stable) were also published. The payload was injected through malicious commits in github.com/Berri-AI/litellm, a hyphenated lookalike of the legitimate BerriAI organization, which fed the release pipeline. The package installs a stealer, internally named privcollect, that harvests browser, cloud, developer and AI provider secrets and exfiltrates them to the attacker-controlled domain www.litellm[.]dev. The PyPI version was quarantined and the Docker tags removed at about 13:53 UTC. The last known safe version is v1.106.2.

   Technical Details

   • Installation drops cook.pth, cook.py and sitecustomize.py into the site-packages root, so the code runs whenever a Python interpreter starts. The .pth file imports cook, which deobfuscates itself, runs the stealer and writes a marker file at /tmp/.pc_once_72129118c59f5636c0bb. The marker write fails on Windows.
   • privcollect has 16 modules. It collects Chrome, Firefox, Edge and Safari credentials and cookies, AWS credentials (~/.aws/, environment variables, EC2/ECS IMDS), GCP service account keys and ADC, Azure CLI token cache, API keys for OpenAI, Anthropic, Cohere and other LLM providers, SSH and GPG keys, and shell history.
   • On LiteLLM Proxy hosts it queries PostgreSQL directly with SELECT * FROM "LiteLLM_CredentialsTable" LIMIT 500 to dump upstream provider keys.
   • Data is encrypted with AES-256-CBC (key wrapped with RSA-4096) and sent by HTTP POST to www.litellm[.]dev/healthcheck with a hardcoded X-Token header and an Internet Explorer 7 user-agent.
   • sitecustomize.py runs on Linux and macOS only. It fetches domain.txt from a GitHub dead drop (letters9813/pythonclient-test) and, if populated, downloads and runs a second-stage Python script from http://<domain>/codepy. The file was never populated at the time of analysis, and the repo was taken down.
   • Between 08:56 and 10:46 UTC the attacker pushed 10 commits using the email [email protected]. The first nine were GitHub-signed, added the persistence files, bumped the version and added data = "cook" to pyproject.toml so the malware is bundled into the wheel. A final unsigned commit under [email protected] added COPY cook ./cook to the Dockerfiles. The commits remain visible via the parent repo through fork object sharing (compare a8113b0d...20535d8f).

   Remediation

   • Identify any host or container that installed or pulled LiteLLM 1.107.0 or the affected Docker tags, and pin to v1.106.2.
   • Search for cook.pth, cook.py, sitecustomize.py and the /tmp/.pc_once_* marker, and hunt for traffic to litellm[.]dev.
   • Treat all secrets on affected systems as compromised and rotate them: cloud credentials, LLM provider API keys, keys in the LiteLLM_CredentialsTable, SSH/GPG keys and browser sessions.
   • Rebuild affected images and environments from known-good sources.
4. aikido.dev ↗ · pub. 21/10/2026 10:05 · coletado 21/10 12:01

   LiteLLM 1.107.0 PyPI wheels and Docker image trojanized with infostealer and persistent Python RAT

   ler a análise desta fonte ocultar

   On October 21, 2026, LiteLLM version 1.107.0, a widely used open source LLM proxy, was found to be compromised. An attacker injected malicious code into the compiled Python wheels published on PyPI, and the official Docker image litellm/litellm:1.107.0 is also affected. The package carries an infostealer that exfiltrates credentials and secrets on first run, and a RAT that lets the attacker execute arbitrary Python on infected hosts every hour. PyPI has quarantined the version, but the Docker image was still live on Docker Hub at the time of reporting. Anyone who installed this version should assume credentials are compromised.

   Technical Details

   • The attacker abused the [tool.maturin] data = "cook" directive in pyproject.toml to bundle a cook/ directory, which exists only in the compromised build environment and not in the source repo, into every wheel.
   • Three files are dropped into site-packages: cook.pth (12 bytes, import cook, runs at every interpreter start), cook.py (the infostealer, a single obfuscated line that decompresses and executes a 61,000-byte payload), and sitecustomize.py (the RAT).
   • The infostealer collects system information, Chromium and Firefox credentials and history, SSH keys, shell history, AWS/Azure/GCP credentials (including instance metadata endpoints), Docker and Kubernetes secrets, CI/CD secrets (GitLab runner, Jenkins, Vault), AI developer tool configs (Claude Code, Cursor, Copilot, Windsurf, Gemini CLI and others), Git/npm/PyPI credentials, GPG/TLS keys, and all environment variables (including /proc/<pid>/environ on Linux). It also dumps LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable from the LiteLLM database.
   • Data is encrypted with a hardcoded RSA-4096 public key and sent by HTTP POST to http://www[.]litellm[.]dev/healthcheck. The sentinel file /tmp/.pc_once_72129118c59f5636c0bb limits it to one run per machine.
   • The RAT forks a daemon that takes the lock /tmp/remote_code_loader.lock. Every hour it fetches the current C2 domain from raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt, then downloads and execs Python from http://{domain}/codepy with no sandboxing.
   • Network indicators: HTTP POST with User-Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0) and header X-Token: XWiA8gZNa7NcX2XRoAEb.

   Remediation

   • Check for /tmp/.pc_once_* (exfiltration already fired) and /tmp/remote_code_loader.lock (C2 daemon ran or is running) on any host that installed litellm==1.107.0 or ran litellm/litellm:1.107.0, including the latest, main-latest and main-stable tags.
   • Treat all credentials, API keys, SSH/GPG/TLS keys, cloud and CI/CD secrets reachable from affected hosts as compromised and rotate them.
   • Remove the affected version and image, hunt for cook.pth, cook.py and sitecustomize.py in site-packages, and block the listed domains and the GitHub C2 lookup path.
   • Rebuild affected hosts or containers from known-good sources.
5. safedep.io ↗ · pub. 20/10/2026 21:00 · coletado 21/10 12:00 primeiro registro

   Compromised LiteLLM 1.107.0 on PyPI Drops Credential Stealer and Remote Code Backdoor via Python Startup Hooks

   ler a análise desta fonte ocultar

   The LiteLLM 1.107.0 release on PyPI was trojanized with a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) install three extra files in site-packages, and two of them run whenever any Python process starts, even one that never imports litellm. The malicious code is not in the upstream GitHub source, and PyPI has since removed the release. SafeDep assesses with moderate to high confidence that BerriAI's private release pipeline built the wheels from attacker-modified git source. The exact cause (compromised maintainer or bot credential, private branch or mirror, or the build reference) can only be confirmed from BerriAI's pipeline logs. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean, as are the pinned companion packages litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78.

   Technical Details

   • Injection: the sdist pyproject.toml has one extra line in the maturin section, data = "cook". It copies a cook/ folder (absent from the sdist) into litellm-1.107.0.data/purelib/, and pip installs it into site-packages. No public commit in BerriAI/litellm contains it.
   • Tag mismatch: tag v1.107.0 (commit 66c8f5b) declares version 1.108.0. The sdist matches a later main commit (a8113b0) plus edited files. The version was reset to 1.107.0 and the companion pins were set to the rc2 values, so a dependency diff against rc2 shows nothing unusual.
   • Build provenance: the wheels were built with maturin 1.9.4, like the legitimate releases, with separate native builds on macOS, Linux and Windows. SafeDep checked 539 public GitHub Actions runs and found none that built the release, and PyPI has no provenance attestations for these versions.
   • Payload 1, cook.pth / cook.py: cook.pth contains import cook, so the stealer runs in every Python process (applications, pip, IDE language servers, CI jobs). The zlib/base64-packed code collects SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and history, shell history, GPG keys, TLS private keys, cloud metadata and the LLM provider keys in a LiteLLM proxy database. Results are encrypted with AES-256-CBC, the key is wrapped with RSA-OAEP (RSA-4096), and the tar.gz is POSTed to www.litellm[.]dev/healthcheck with an X-Token header. A marker file limits collection to once per host.
   • Payload 2, sitecustomize.py: it takes a lock file, forks and detaches a daemon, and every hour reads a domain from domain.txt in the attacker's GitHub repository, re-runs an embedded stealer copy with no once-per-host marker, and downloads and exec()s code from http://<domain>/codepy.
   • Takedown: at 13:40 UTC on 2026-10-21 the GitHub account letters9813 and its repository returned 404, so the backdoor currently finds no server address. Hosts whose daemon ran earlier could have received second-stage code. SafeDep could not recover the server address.

   Remediation

   • Check for litellm==1.107.0 in environments, lockfiles, containers and CI caches. Treat any host that installed it as compromised.
   • Look for cook.pth, cook.py and sitecustomize.py in site-packages, /tmp/.pc_once_72129118c59f5636c0bb, /tmp/remote_code_loader.lock, and traffic to litellm[.]dev.
   • Rotate all credentials reachable from affected hosts: SSH keys, cloud and CI/CD secrets, AI tool tokens, LLM provider keys and browser-stored passwords.
   • Because second-stage code may have run, consider rebuilding affected hosts. Pin known-good versions (1.106.2 or 1.107.0rc2).