Malicious LiteLLM 1.107.0 on PyPI shipped an infostealer and RAT
Original title: LiteLLM Compromised – Hackers Injected an Infostealer and RAT in the Latest 1.107.0 PyPI Release
All seven wheels and several Docker tags were tainted; PyPI removed the release, and Wiz calls 1.106.2 the latest safe build.
On October 21, 2026, LiteLLM 1.107.0 on PyPI installed a credential stealer and a remote-access loader through every distributed wheel, and the same release reached container images. Python startup files cook.pth, cook.py, and sitecustomize.py run even if LiteLLM is never imported, steal cloud, SSH, browser, and AI-tool secrets, and post them to an attacker-controlled litellm lookalike host. A second stage fetches a GitHub domain.txt that Wiz found empty before the repo was removed. Aikido said installers should assume credentials were exposed; removing the package does not clear installed malware or stolen secrets.
Unconfirmed: Wiz found domain.txt empty, so second-stage execution was not confirmed, and the intrusion path and attacker identity are unknown.
- Socket said its scanner flagged all seven wheels seven minutes after publication.
- Affected image tags include v1.107.0, latest, main-latest, and main-stable.
- The stealer writes a marker at /tmp/.pc_once_72129118c59f5636c0bb, which can fail on Windows.
- Build records mention lookalike Berri-AI/litellm versus legitimate BerriAI/litellm.
- This is LiteLLM’s second reported supply-chain compromise this year; earlier versions were 1.82.7 and 1.82.8.
Impact: Steals cloud, SSH, browser, and AI-tool credentials
| Product | Affected | Fixed in |
|---|---|---|
| BerriAI LiteLLM | 1.107.0 | 1.106.2 |
| BerriAI LiteLLM container images | v1.107.0, latest, main-latest, and main-stable | — |
- 1.Assume secrets on hosts that installed 1.107.0 were stolen and rotate them from a clean system.
- 2.Isolate affected hosts and runners and remove cook.pth, cook.py, and sitecustomize.py.
- 3.Rebuild from trusted sources, prefer 1.106.2, and pin images to verified digests.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.litellm.dev | ation is encrypted and sent through an HTTP POST request to www[.]litellm[.]dev/healthcheck . Wiz identifies the destination as attacke |
From the original article
3 min read at cybersecuritynews.com
LiteLLM version 1. 107. 0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed wheel files.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.