Anyone who installed LiteLLM version 1.107.0 on October 21 got a credential stealer along with it. Wiz Research says the malicious release was uploaded to PyPI at 11:39 UTC and also shipped inside LiteLLM's official Docker images on GitHub Container Registry and Docker Hub, under the v1.107.0, latest, main-latest and main-stable tags.
LiteLLM is an open source gateway that applications use to route requests to large language models, which makes the machines it runs on a good place to find AI provider keys and cloud credentials. Per the original report, PyPI has since quarantined the version, and the most recent safe release is v1.106.2.
It runs every time Python starts
The poisoned package drops three files straight into the site-packages root: cook.pth, cook.py and sitecustomize.py. Python processes .pth files and sitecustomize automatically at interpreter startup, so the code does not wait for anyone to import LiteLLM. Any Python process on the machine can trigger it.
According to Wiz, cook.pth imports cook.py, which deobfuscates itself, collects system, browser, developer, cloud and AI tool secrets, encrypts them and posts them to www[.]litellm[.]dev/healthcheck, an attacker-controlled domain dressed up as LiteLLM infrastructure. It leaves a marker file at /tmp/.pc_once_72129118c59f5636c0bb, a step Wiz notes fails on Windows, where that path often does not exist.
The second file is a dormant backdoor. On Linux and macOS, sitecustomize.py polls a GitHub dead drop (letters9813/pythonclient-test, file domain.txt) for a domain, then would download and run a second-stage script from hxxp://<domain>/codepy. Wiz says the file was never populated during its analysis and the repository was taken down at 13:30 UTC.
A second hit on the same project
This is not LiteLLM's first supply chain compromise this year. In March, a group tracked as Team PCP got malicious LiteLLM builds onto PyPI, and CloudSEK later counted more than 2,500 organizations potentially exposed, as we reported in AI supply chain hack exposed 2,500 companies' secrets. Wiz has not attributed the October 21 release to anyone, and nothing in its report links the two incidents.
Pin to 1.106.2 and hunt for cook.pth
- Check every environment, CI runner and container for LiteLLM 1.107.0, and for images pulled by the latest, main-latest or main-stable tags on October 21. Pin to v1.106.2, ideally by image digest.
- Look for
cook.pth,cook.pyor an unexpectedsitecustomize.pyin site-packages, and for the marker file in /tmp. - Search proxy and DNS logs for litellm[.]dev.
- Treat any host that ran the package as having lost its secrets, and rotate browser-stored, cloud, developer and AI provider credentials accordingly.
Indicators
- Exfiltration endpoint: www[.]litellm[.]dev/healthcheck
- Dead drop: github[.]com/letters9813/pythonclient-test (domain.txt)
- litellm-1.107.0 manylinux x86_64 wheel: 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7
- litellm-1.107.0 win_amd64 wheel: 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484
- ghcr.io/berriai/litellm:v1.107.0 and docker.io/litellm/litellm, linux/amd64: sha256:bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5
- Same images, linux/arm64: sha256:56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf
Wiz's report lists hashes for every wheel and for the litellm-database and litellm-non_root images as well. The window here was a matter of hours, but for a package that sits next to a company's AI keys, a few hours on the latest tag is all an attacker needs.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.