Malicious LiteLLM 1.107.0 Release Stole Credentials From Developer Environments
LiteLLM’s release pipeline was compromised on October 21, and attackers published version 1.107.0 to PyPI and container registries. The malicious release affected all seven PyPI wheels for Windows, Linux, and macOS, creating a supply-chain incident for organizations using the open-source AI gateway. The project’s recommended clean recovery version is 1.106.2.
The affected package was not merely carrying altered application code. Researchers found three files—cook.pth, cook.py, and sitecustomize.py—placed in Python’s library directory. Python processes executable .pth lines during startup and attempts to import sitecustomize, so the payload could run before the application itself. Even launching Python or pip to investigate an affected environment could trigger the malware.
The malware targeted credentials and secrets used across development and cloud operations. Listed targets included AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub, npm, PyPI, CI/CD systems, .env files, SSH, GPG and TLS keys. It also sought AI-tool authentication files, LiteLLM provider credentials, browser data, shell histories, environment variables, and system information.
The exposure was time-limited but significant. The PyPI wheels were available from 11:39:51 to 13:23 UTC, while compromised Docker Hub tags pointed to the malicious image index from 11:46:56 to 14:20 UTC. GHCR images were made unavailable by 13:51 UTC. Those windows do not establish whether a particular installation was compromised; they identify when the altered artifacts were available.
Affected users should stop deployments using the compromised artifacts and inspect environments without launching the Python interpreter. Infected systems should be isolated and rebuilt from clean backups, and exposed secrets should be rotated immediately. Removing only the LiteLLM package directory may not be enough because startup files or an active loader could remain. The evidence also describes a loader that checks a GitHub-hosted pointer hourly and can download Python from an external server for execution on the host.
The incident matters beyond a single dependency because LiteLLM is used as a common API layer for applications accessing models from different providers. The attack therefore placed credentials and deployment secrets in environments that may connect AI services to wider cloud and software-delivery infrastructure. Organizations should treat an installation of 1.107.0 as a potential credential-exposure event rather than as a package replacement exercise.