Malwarehigh
Trojanized LiteLLM 1.107.0 on PyPI steals credentials
Original title: LiteLLM Compromised, Steals Credentials
AI summary · x-ai/grok-4.7Summaries by Vani AI
PyPI quarantined the upload within about two hours; matching Docker tags included latest, main-latest and main-stable.
Wiz says a malicious LiteLLM 1.107.0 was uploaded to PyPI at 11:39 UTC on October 21 and quarantined at 1:20 UTC. The same build was in GHCR and Docker Hub images under v1.107.0, latest, main-latest and main-stable. On startup, cook.pth loads a stealer that sends system, browser, developer, cloud and AI secrets to www.litellm.dev; a Linux and macOS loader can fetch a second stage that Wiz says was never activated. Wiz calls v1.106.2 the most recent safe version.
Unconfirmed: Wiz says the second-stage domain.txt file was never populated and that payload was not observed active.
Key facts
- The run-once marker /tmp/.pc_once_72129118c59f5636c0bb fails on Windows.
- sitecustomize.py read a GitHub dead drop that was never populated.
- The letters9813/pythonclient-test repository was taken down by 1:30 PM UTC.
- Wiz published wheel and container SHA256 hashes for the trojanized builds.
Security assessment · AI, from the article
Impact: Steals system, browser, developer, cloud and AI secrets
| Product | Affected | Fixed in |
|---|---|---|
| BerriAI LiteLLM | 1.107.0; Docker tags v1.107.0, latest, main-latest, main-stable | v1.106.2 |
What to do
- 1.Do not install LiteLLM 1.107.0 or the named Docker tags; use v1.106.2.
- 2.Look for cook.pth, cook.py, sitecustomize.py and PRIVCOLLECT_ACTIVE=1.
- 3.Block www.litellm.dev/healthcheck and review the Wiz supply-chain advisory.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | teLLM . Indicators of Compromise Indicator Description Type litellm[.]dev Attacker-controlled exfil (lookalike) Network www.litellm |
| domain | www.litellm.dev | cloud and AI tool secrets, encrypts them and exfiltrates to www.litellm.dev/healthcheck via a post request. This domain is attacker con |
| sha256 | 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a | 5729aeb86d litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl 66816 |
| sha256 | 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 | 44fe583272aff7ad00 litellm-1.107.0-cp310-abi3-win_amd64.whl 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 ghcr.io/berriai/litellm:v1.107.0 linux/amd64 sha256:bd1aeee |
| sha256 | 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 | dcde054 litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 litellm-1.107.0-cp310-abi3-win_amd64.whl 12d4ccc5c6f8d35cf4 |
| sha256 | 24581ddc30767f16ecb69d2b0517556f2cd7dea56971adb42a3d1beb97d69523 | hcr.io/berriai/litellm-database:v1.107.0 linux/amd64 sha256:24581ddc30767f16ecb69d2b0517556f2cd7dea56971adb42a3d1beb97d69523 linux/arm64 sha256:827dd893c74cf621a860a66a3a447a5c732533f0 |
| sha256 | 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 | e02ae6 litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl c2e32d |
| sha256 | 56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf | 288da4101887be468f020ac63d22ba6ed84a3ea5 linux/arm64 sha256:56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf ghcr.io/berriai/litellm-database:v1.107.0 linux/amd64 sha25 |
| sha256 | 645a67d810628252d63df85dcc8824c58bcc77cf8383f4d3e6321f0ccc3ce9e4 | hcr.io/berriai/litellm-non_root:v1.107.0 linux/amd64 sha256:645a67d810628252d63df85dcc8824c58bcc77cf8383f4d3e6321f0ccc3ce9e4 linux/arm64 sha256:f75c8edae59b72b1ebfd617295833f465c85bb2f |
| sha256 | 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 | d9a1a litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl 462d0c |
| sha256 | 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d | e SHA256 litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl 0aaf7ba346 |
| sha256 | 827dd893c74cf621a860a66a3a447a5c732533f087589ce905573e285c0a239c | 0517556f2cd7dea56971adb42a3d1beb97d69523 linux/arm64 sha256:827dd893c74cf621a860a66a3a447a5c732533f087589ce905573e285c0a239c ghcr.io/berriai/litellm-non_root:v1.107.0 linux/amd64 sha25 |
| sha256 | bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5 | 05b9484 ghcr.io/berriai/litellm:v1.107.0 linux/amd64 sha256:bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5 linux/arm64 sha256:56b74573eed6e4aafe4b50603dbe7853e0345f18 |
| sha256 | c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 | a6fcf7 litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl 1bbce8c |
| sha256 | f75c8edae59b72b1ebfd617295833f465c85bb2fab9c1d60f21b496db86cb8da | cc8824c58bcc77cf8383f4d3e6321f0ccc3ce9e4 linux/arm64 sha256:f75c8edae59b72b1ebfd617295833f465c85bb2fab9c1d60f21b496db86cb8da docker.io/litellm/litellm linux/amd64 sha256:bd1aeee419ea36 |
From the original article
2 min read at wiz.io
In a new incident, a malicious version (1. 107. 0) of the LiteLLM package was uploaded to PyPI and Docker on October 21.
By Benjamin Read · wiz.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.