LiteLLM 1.107.0 Compromised: Credential Stealer and Backdoor Detected on PyPI

On October 21, 2026, the LiteLLM 1.107.0 package on PyPI was compromised, installing a credential stealer and remote-code backdoor that harvested tokens from AI development tools like Claude Code, Cursor, and Copilot, alongside SSH keys and cloud credentials.

Details of the Compromise

The malicious LiteLLM 1.107.0 package, distributed across all seven platform wheels (Linux, macOS, and Windows), incorporated a sophisticated attack mechanism. The malware was designed to activate whenever any Python process initiated on an infected system, primarily due to a planted cook.pth file. This file acted as a loader, initiating the credential-stealing process.

Further investigation revealed that the attackers successfully stole GitHub CLI credentials from three developers and subsequently hijacked LiteLLM's official build pipeline. This allowed the malicious artifacts to be built, signed, and published using LiteLLM's own infrastructure, lending them an appearance of legitimacy.

Malware Functionality and Impact

The compromise involved three distinct files:

• cook.pth: A loader file that ensured the malware executed with any Python process.
• cook.py: The primary credential stealer module.
• sitecustomize.py: An hourly backdoor daemon, providing persistent remote code execution capabilities.

The credential stealer was designed to harvest a wide array of sensitive information. This included tokens from various AI dev tools such as Claude Code, Cursor, Windsurf, Copilot, Gemini CLI, Codex, and Hugging Face. Additionally, it targeted SSH keys, AWS, Azure, and GCP credentials, CI/CD secrets, browser passwords, and keys for various LLM providers. Stolen data was encrypted using AES-256-CBC, key-wrapped with RSA-OAAP, and then transmitted via POST requests to www.litellm[.]dev/healthcheck.

The implant was introduced through a single line, maturin data = "cook", added to the sdist's pyproject.toml file.

Affected Docker Images and Remediation

Beyond PyPI, infected Docker images were also live on Docker Hub and GHCR. These images were available between 11:46 UTC and 14:20 UTC on October 21, 2026. While PyPI removed the compromised package swiftly, users who pulled Docker images during this window may have been exposed.

LiteLLM has confirmed the compromise in an official incident report. Users who installed LiteLLM version 1.107.0 are strongly advised to downgrade to a clean version and immediately rotate all credentials that may have been exposed. Clean versions identified include 1.106.2, 1.107.0rc1, and 1.107.0rc2. For developers using LiteLLM, verifying the installed version and taking corrective action is critical.

Key Takeaways for Developers

• Immediate Action: If you installed LiteLLM 1.107.0, downgrade to a clean version (1.106.2, 1.107.0rc1, or 1.107.0rc2) and rotate all potentially compromised credentials.
• Supply Chain Vigilance: This incident underscores the importance of verifying software packages, even from trusted sources like PyPI and Docker Hub.
• Credential Security: Regularly review and rotate API keys, cloud credentials, and SSH keys, especially after any suspected security incident.
• Monitoring: Implement robust monitoring for unusual network activity or unauthorized access attempts within development environments.

Conclusion

The compromise of LiteLLM 1.107.0 serves as a critical reminder of the persistent threats within software supply chains. The swift action by PyPI to remove the malicious package, coupled with LiteLLM's incident report, provides a clear path for remediation. Developers must remain vigilant, prioritize security best practices, and promptly address advisories to protect their systems and data from sophisticated attacks.

Sources

• [SECURITY] litellm 1.107.0 compromised (PyPI removed; Docker latest/main-stable STILL infected): cook.pth credential stealer + sitecustomize RCE loader, built from lookalike repo Berri-AI/litellm · Issue #47826 · BerriAI/litellm · GitHub
• PyPI has quarantined litellm · Issue #24517 · BerriAI/litellm · GitHub
• [Security Advisory] LiteLLM supply chain compromise - update to latest ADK Python · Issue #5005 · google/adk-python · GitHub
• Security Advisory: Litellm Supply Chain Attack · HKUDS/nanobot · Discussion #2445 · GitHub
• GitHub - yuxiaopeng/hacker-news-summarizer: 使用Google Gemini API，对hacker news Top100文章总结摘要并翻译成体中文，每日自动更新。 · GitHub