Malicious LiteLLM 1.107.0 published with a credential stealer
Original title: LiteLLM supply chain compromise: What you need to know
PyPI and official Docker tags carried the release for about two hours; the RAT dead-drop never delivered a live second stage.
On October 21, 2026, attackers published litellm 1.107.0, a malicious release of the popular LLM proxy library, to PyPI and LiteLLM’s official Docker images. According to LiteLLM’s analysis, stolen GitHub CLI OAuth tokens from three engineers launched the private release workflow against a lookalike fork. The package drops a credential stealer that runs whenever Python starts and a backdoor that checks a GitHub file for further code. PyPI quarantined the version and the images were removed; how the tokens were first stolen is still unclear.
Unconfirmed: How the three GitHub CLI OAuth tokens were initially stolen is unknown, and no connection to the earlier TeamPCP-linked incident is established.
- litellm has about 23 million weekly downloads; affected release is 1.107.0.
- Docker tags included v1.107.0, latest, main-latest and main-stable.
- Payloads cook.pth, cook.py and sitecustomize.py persist after the package directory is deleted.
- Exfiltration goes to www.litellm[.]dev and targets cloud, developer, AI-tool, browser and proxy secrets.
- An earlier 2026 compromise of 1.82.7 and 1.82.8 was linked to TeamPCP; no link is established here.
Impact: Steals cloud, developer, AI-tool, browser and proxy credentials
| Product | Affected | Fixed in |
|---|---|---|
| BerriAI litellm | 1.107.0 | 1.106.2 |
- 1.Manually remove cook.pth, cook.py and sitecustomize.py from site-packages.
- 2.Remove litellm 1.107.0 and revert to litellm 1.106.2.
- 3.From a clean machine, rotate exposed credentials and audit logs for the exposure window.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | pted with AES-256 and RSA-4096, to the lookalike domain www.litellm[.]dev/healthcheck . Backdoor ( sitecustomize.py ): Every hour, |
| sha256 | 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a | 75729aeb86d Malicious litellm macOS x86-64 .whl hash sha256:0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a Malicious litellm macOS ARM64 .whl hash sha256:462d0c9f67ca |
| sha256 | 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 | 2fdcde054 Malicious litellm musllinux ARM64.whl hash sha256:12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 Malicious litellm Windows x86-64 .whl hash |
| sha256 | 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e | ecustomize.py Payload file dropped into sitepackages sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e Infected litellm image index sha256:7598727f209d717041db37f |
| sha256 | 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 | d5e02ae6 Malicious litellm manylinux ARM64 .whl hash sha256:1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 Malicious litellm musllinux x86-64 .whl hash sha256:c2e32d0 |
| sha256 | 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 | 78a9969d9a1a Malicious litellm macOS ARM64 .whl hash sha256:462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 Malicious litellm manylinux x86-64 .whl hash sha256:668169d |
| sha256 | 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 | 4a6fcf7 Malicious litellm manylinux x86-64 .whl hash sha256:668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 Malicious litellm manylinux ARM64 .whl hash sha256:1bbce8ca |
| sha256 | 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d | 15fb6c664cdd3ac126c339e Infected litellm image index sha256:7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d Malicious litellm macOS x86-64 .whl hash sha256:0aaf7ba346d |
| sha256 | c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 | ff7ad00 Malicious litellm musllinux x86-64 .whl hash sha256:c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 Malicious litellm musllinux ARM64.whl hash sha256:12d4ccc5c |
From the original article
3 min read at securitylabs.datadoghq.com
Malicious releases of LiteLLM v1. 107. 0 were published to PyPI and container registries following multiple maintainer account compromises.
By @datadoghq · securitylabs.datadoghq.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.