Compromised LiteLLM 1.107.0 on PyPI installs a stealer and backdoor
Original title: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
All seven wheels run the implants in every Python process; PyPI removed the release, and 1.106.2 plus two release candidates are clean.
SafeDep reports that LiteLLM 1.107.0 on PyPI carried a credential stealer and a remote code execution backdoor that are absent from the upstream GitHub source. All seven Linux, macOS, and Windows wheels install cook.pth, cook.py, and sitecustomize.py so they run when any Python process starts. The stealer collects host, cloud, CI, browser, and LLM-provider secrets and sends encrypted data to www.litellm[.]dev, while a daemon hourly fetches a server address and runs downloaded code. PyPI has removed the release.
Unconfirmed: SafeDep assesses with moderate to high confidence that BerriAI’s private pipeline built the wheels from modified source, and says only pipeline logs can confirm the cause.
- Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are reported clean.
- Pinned packages litellm-proxy-extras 0.4.110 and litellm-enterprise 0.1.78 are also clean.
- SafeDep found no public GitHub Actions run that built or published the release.
- The sdist adds a maturin data setting that copies a cook folder absent from public commits.
Impact: Steals credentials and runs remotely supplied code
| Product | Affected |
|---|---|
| BerriAI LiteLLM | 1.107.0 |
- 1.Do not install LiteLLM 1.107.0; use 1.106.2, 1.107.0rc1, or 1.107.0rc2.
- 2.If 1.107.0 was installed, check site-packages for cook.pth, cook.py, and sitecustomize.py.
- 3.Rotate credentials the stealer targets if that release ran.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1552.001 Credentials In FilesT1555.003 Credentials from Web BrowsersT1105 Ingress Tool Transfer
- Vendors
- BerriAI
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | LM proxy database. It encrypts the data and sends it to www.litellm[.]dev . sitecustomize.py starts a background daemon. Every hour |
| sha256 | 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a | 5729aeb86d litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a litellm-1.107.0-cp310-abi3-win_amd64.whl 12d4ccc5c6f8d35cf4 |
| sha256 | 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 | 3f121078a9969d9a1a litellm-1.107.0-cp310-abi3-win_amd64.whl 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 The planted files, from the wheel RECORD : File SHA-256 (UR |
| sha256 | 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 | 5e02ae6 litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl c2e32d |
| sha256 | 2befe2a79fb4fbbd9a543b5b40b530c8cffa8771bab22b8fb22b2e4ae3b1f819 | p File hashes (SHA-256) File SHA-256 litellm-1.107.0.tar.gz 2befe2a79fb4fbbd9a543b5b40b530c8cffa8771bab22b8fb22b2e4ae3b1f819 litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl 462d0c |
| sha256 | 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 | b1f819 litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl 66816 |
| sha256 | 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 | 6fcf7 litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl 1bbce8c |
| sha256 | 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d | fdcde054 litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl 0aaf7ba346 |
| sha256 | c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 | f7ad00 litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl 7598727f |
| url | http://www.litellm.dev/healthcheck | of compromise Network Indicator Purpose www.litellm[.]dev , hxxp://www.litellm[.]dev/healthcheck Receives stolen data HTTP header X-Token: XWiA8gZNa7NcX2X |
From the original article
6 min read at safedep.io
The LiteLLM 1. 107. 0 release on PyPI carries a credential stealer and a remote code execution backdoor.
By abhisek · safedep.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.