Hackers compromised LiteLLM version 1.107.0 on the Python Package Index on October 21, 2026, planting a credential stealer and a remote access trojan inside all seven distributed wheel files. The malicious release also reached Docker images on GitHub Container Registry and Docker Hub, putting developer systems, build runners, and AI services at risk.
How the Payload Activates
According to Wiz’s technical analysis, installation drops three files—cook.pth, cook.py, and sitecustomize.py—directly into Python’s site-packages directory. When Python starts, cook.pth imports cook.py, which decodes its hidden code and launches the credential theft routine. This design means an unrelated Python command can trigger the payload after installation, even when the user never imports LiteLLM directly.
A separate startup file, sitecustomize.py, creates a remote code loading path on Linux and macOS. It attempts to retrieve domain.txt from the GitHub repository letters9813/pythonclient-test, then uses the returned address to download and execute another Python script from a /codepy endpoint. Wiz reported that domain.txt had not been populated during its analysis and that the repository was subsequently taken down.
What the Stealer Targets
The malware searches for system information, browser data, developer secrets, cloud credentials, and authentication files used by AI tools. Reported targets include SSH private keys, AWS, Google Cloud, and Azure credentials, browser passwords, and tokens for tools such as Claude and GitHub Copilot. Collected information is encrypted and sent through an HTTP POST request to www.litellm.dev/healthcheck, a destination Wiz identifies as attacker controlled and designed to resemble legitimate LiteLLM infrastructure.
The stealer also writes a marker at /tmp/.pc_once_72129118c59f5636c0bb, although that path can fail on Windows. Aikido warned that anyone who installed the affected release should assume credentials were exposed. PyPI removed version 1.107.0, but taking down the package does not remove malware already installed or invalidate secrets attackers may have stolen.
Container Images Also Compromised
Wiz identified affected LiteLLM images on GitHub Container Registry and Docker Hub, including tags v1.107.0, latest, main-latest, and main-stable. A familiar image tag therefore does not establish that a deployment is clean. The malicious release reached Docker images, putting developer systems, build runners, and AI services at risk across containerized environments.
Public incident discussion also points to build records naming Berri-AI/litellm, a lookalike repository that differs from the legitimate BerriAI/litellm project by one hyphen. That finding raises questions about release sourcing and how the poisoned artifacts entered the official distribution channels.
Detection and Response
Socket’s investigation said its scanner flagged all seven wheels seven minutes after publication. Detection speed matters because automated dependency updates can pull a poisoned release into multiple environments before a human reviews the package change. Security teams should audit any environment that may have pulled LiteLLM 1.107.0 or the affected container tags, rotate all credentials that the stealer targets, and treat any secrets present during the exposure window as compromised.
Persistence and Remote Execution Capabilities
The malicious payload includes a remote code loading path on Linux and macOS, which provides attackers a route to run additional code whenever affected Python environments start again. This functionality is facilitated by the sitecustomize.py file, which attempts to retrieve a domain.txt file from the GitHub repository letters9813/pythonclient-test. The malware then uses the returned address to download and execute another Python script from a /codepy endpoint.
While this design grants the potential for ongoing remote control, Wiz noted that such capability should not be confused with confirmed activity. During its analysis, Wiz reported that the domain.txt file had not been populated and that the associated repository was subsequently taken down. This suggests that while the infrastructure for secondary code execution was established within the compromised LiteLLM release, the attackers may not have successfully utilized this specific remote loading mechanism before the repository was removed.
Sources
- LiteLLM Compromised – Hackers Injected an Infostealer and RAT in the Latest 1.107.0 PyPI Release
- LiteLLM supply chain attack hoovers up passwords and secrets
- China-Linked Hackers Turn Trusted Windows Applications Into Backdoors to Steal Credentials
Photo: Wikideas1 (CC0)
