An attacker gained access to LiteLLM's build infrastructure and released a poisoned version containing malware designed to exfiltrate sensitive data. The compromise affected installation packages distributed through multiple channels, including PyPI wheels and container registries, exposing users of the widely-deployed Python SDK and AI gateway.

LiteLLM version 1.107.0 contained the malicious payload and was made available across multiple platforms. The project maintains significant adoption, with 61,800 GitHub stars, 92 million monthly PyPI downloads, and deployment at organizations including NVIDIA, Netflix, AT&T, and Okta.

According to the maintainer, the release pipeline was compromised on October 21. A threat actor pushed the infected version 1.107.0 to both Docker Hub and PyPI. The statement notes that "This version contained compiled malware which steals credentials and loads remote-code execution tools," though customers using the private enterprise offering were unaffected.

Scope of the compromise

The attack distributed malicious artifacts across multiple registries during the following windows:

  • PyPI: litellm==1.107.0 with all seven wheels, active from 11:39:51 to 13:23 UTC
  • Docker Hub: tags v1.107.0, latest, main-latest, and main-stable pointing to compromised image sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTC
  • GHCR: tags v1.107.0, latest, main-latest, and main-stable pointing to compromised indexes from 11:46:56 UTC until removal at 13:51 UTC, including ghcr.io/berriai/litellm (sha256:1bbcb1443bc9…), ghcr.io/berriai/litellm-database (sha256:c00f9d92c427…), and ghcr.io/berriai/litellm-non_root (sha256:7b00e91cd2fe…)

Attack mechanism

Security researchers from multiple firms detected the attack within six minutes of the malicious release. Analysis revealed that the attacker left the LiteLLM application code untouched and instead injected three malicious files—cook.pth, cook.py, and sitecustomize.py—into the Python library directory of the installation package.

Socket researchers explained the execution flow: "During normal startup, Python processes executable .pth lines and then attempts to import sitecustomize." Endor Labs noted that this approach ensures the payloads execute before the application launches every time Python runs in the environment. Even running Python or pip commands to investigate an affected installation would trigger the malware.

Data targeted by the malware

The payload was designed to harvest multiple categories of sensitive information:

  • Cloud and deployment credentials: AWS, Azure, Google Cloud, Kubernetes, Docker, and infrastructure-management secrets
  • AI credentials and configuration: Authentication files for AI development tools, plus LiteLLM's stored provider credentials and model settings
  • Developer secrets and private keys: Git, GitHub, npm, PyPI, and CI/CD credentials; .env files; SSH, GPG, and TLS keys
  • Browser data: Saved login, cookie, autofill/payment, and browsing-history databases
  • Host and runtime data: Environment variables, shell and application histories, and system and network information

Stolen data undergoes encryption using AES-256-CBC with a key encrypted by RSA-4096, then uploads to 'litellm[.]dev/healthcheck'. The sitecustomize.py file launches a detached loader that queries a GitHub-hosted pointer every hour and downloads Python code from an external server for execution.

Remediation guidance

The malicious packages have been removed from registries. Organizations that may have deployed the affected version should halt those deployments and examine systems without invoking the Python interpreter, as running Python or pip can activate the malware.

Removing only the LiteLLM package directory is insufficient; startup files or an active loader may persist. Infected systems require isolation and rebuilding from verified clean backups. All potentially exposed credentials must be rotated immediately.

LiteLLM 1.106.2 is the recommended recovery version, representing the latest clean release prior to the attack.

Prior incident

This marks the second significant supply-chain incident affecting LiteLLM. In March, the TeamPCP hacking group published malicious LiteLLM versions on PyPI after compromising Aqua Security's Trivy vulnerability scanner, which LiteLLM used in its CI/CD pipeline.