LiteLLM PyPI Release 1.107.0 Compromised with Infostealer and RAT
LiteLLM's latest PyPI release, version 1.107.0, was compromised to distribute malware, including an infostealer and a remote access trojan, affecting developers and AI services.
LiteLLM version 1.107.0, released on the Python Package Index (PyPI) on October 21, 2026, was found to be compromised, distributing malicious code within all seven of its wheel files. This malicious release also extended to Docker images, posing a significant risk to developer systems, build runners, and various AI services. Security researchers at Aikido warned that any user who installed this affected version should assume their credentials have been compromised.
While PyPI has since removed version 1.107.0, the removal does not eliminate the malware already installed on user systems nor does it invalidate any secrets that attackers may have successfully exfiltrated. Socket's security scanners detected the malicious package just seven minutes after its publication, highlighting the critical speed at which automated dependency updates can introduce poisoned releases into development environments before human oversight can intervene.
The attack mechanism employed by the threat actors is particularly insidious, leveraging Python's startup hooks rather than relying on direct imports of the LiteLLM library. According to Wiz's technical analysis, the installation process injects three files—cook.pth, cook.py, and sitecustomize.py—directly into the Python site-packages directory. When a Python interpreter starts, cook.pth triggers the execution of cook.py, which then decodes and initiates the credential theft routine. This means that even unrelated Python commands can activate the malware payload post-installation, irrespective of whether LiteLLM itself is directly invoked.
The credential stealer is designed to harvest a wide array of sensitive information, including system details, browser data, developer secrets, cloud service credentials, and authentication tokens for AI tools. Specifically targeted are SSH private keys, credentials for major cloud providers like AWS, Google Cloud, and Azure, stored browser passwords, and API tokens for services such as Claude and GitHub Copilot. The stolen data is encrypted and transmitted via HTTP POST requests to a domain, www[.]litellm[.]dev/healthcheck, which Wiz identified as attacker-controlled and designed to mimic legitimate LiteLLM infrastructure.
In addition to the credential theft, a separate startup file, sitecustomize.py, provides a mechanism for remote code execution on Linux and macOS systems. This component attempts to retrieve a domain list from a GitHub repository (letters9813/pythonclient-test) and subsequently uses the obtained address to download and execute additional Python scripts from a /codepy endpoint. This capability offers attackers a persistent backdoor to run arbitrary code whenever affected Python environments restart. However, Wiz noted that the domain.txt file was not populated during their analysis, and the repository was later taken down, suggesting this specific remote execution path may not have been fully activated.
Users of containerized environments also face risks, as Wiz identified affected LiteLLM images on the GitHub Container Registry and Docker Hub, including tags like v1.107.0, latest, main-latest, and main-stable. This means that even familiar image tags do not guarantee a clean deployment. Further investigation points to a lookalike repository, Berri-AI/litellm, which differs from the legitimate BerriAI/litellm project by a single hyphen, raising concerns about the validation of release sources and the full intrusion vector.
Organizations that installed LiteLLM version 1.107.0 are strongly advised to isolate affected hosts and build runners, preserve relevant logs for forensic analysis, and treat all accessible secrets as compromised. Investigations should encompass package installation records, container deployments, Python startup file modifications, and outbound network connections to the identified collection endpoint. It is crucial to rotate and revoke compromised cloud keys, SSH keys, browser sessions, repository tokens, and AI service credentials from a secure, clean system. Simply replacing the LiteLLM package is insufficient, as stolen credentials can grant attackers access to other systems and services.
Wiz identified version 1.106.2 as the last known safe version. To mitigate further risks, affected environments should be rebuilt from trusted sources, and container deployments should be pinned to verified image digests rather than relying on mutable tags. Reviewing cloud and source control logs for any anomalous activity post-installation is also recommended. This incident marks LiteLLM's second reported supply chain compromise this year, underscoring the persistent challenges in securing software supply chains and the long-term security implications of even brief package exposures.