Compromised LiteLLM 1.107.0 steals credentials via Python startup
Original title: Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Starting Python with the package installed can run PRIVCOLLECT without importing LiteLLM; removing the package does not recover credentials.
On October 21, 2026, a compromised LiteLLM 1.107.0 release reached PyPI and official container images. Malicious cook.pth, cook.py, and sitecustomize.py files executed during normal Python startup, so an application did not need to import LiteLLM. Microsoft says the collector targeted developer, cloud, browser, SSH, environment, and LiteLLM proxy credentials, then encrypted and sent them out. Maintainers say stolen GitHub credentials redirected publishing to Berri-AI/litellm; Microsoft has not confirmed the initial access.
Unconfirmed: Microsoft has not independently determined the initial access or how the upstream credentials were obtained.
- Startup files were packaged under litellm-1.107.0.data/purelib/ and installed into the library directory.
- cook.pth imports cook.py, which decodes an embedded program named PRIVCOLLECT.
- A set PRIVCOLLECT_ACTIVE variable skips duplicate collection in child processes.
- After HTTP 200, the collector tries to write /tmp/.pc_once_72129118c59f5636c0bb.
- A Unix path could fetch more Python code; Microsoft did not confirm that activity.
Impact: Theft of developer, cloud, browser, SSH, and LiteLLM credentials
| Product | Affected |
|---|---|
| BerriAI LiteLLM | 1.107.0 |
- 1.Do not run Python or pip in a suspect environment to check for the package.
- 2.Treat package removal as insufficient; clean the environment and surviving processes.
- 3.Rotate credentials accessible to the compromised identity.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1059.006 PythonT1552.001 Credentials In FilesT1041 Exfiltration Over C2 Channel
- Vendors
- BerriAI
- Products
- LiteLLM
- Malware
- PRIVCOLLECT
- Organizations
- Microsoft
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | www.litellm.dev | envelope metadata. It then attempts an HTTP POST to hxxp://www[.]litellm[.]dev/healthcheck , using application/octet-stream , a fixed |
| domain | www.litellm.dev.example | ampaign domain. The query rejects suffix lookalikes such as www[.]litellm[.]dev[.]example; a match still needs process and workload context. De |
| sha256 | 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea | 6f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25", "03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea", "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5 |
| sha256 | 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa | 752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea", "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa", "b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680d |
| sha256 | 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25 | an equivalent match. DeviceFileEvents | where SHA256 in~ ( "9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25", "03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3 |
| sha256 | b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465 | e88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa", "b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465") | project Timestamp, DeviceId, DeviceName, ActionType, Fi |
| url | http://www.litellm.dev/healthcheck | aintext envelope metadata. It then attempts an HTTP POST to hxxp://www[.]litellm[.]dev/healthcheck , using application/octet-stream , a fixed browser-like |
From the original article
11 min read at microsoft.com
Microsoft Threat Intelligence analyzes the LiteLLM 1. 107. 0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations.
microsoft.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.