Malicious LiteLLM 1.107.0 Release Steals Credentials Through Python Startup Hooks

Oct 21, 2026 · Original article ↗

Summary

Socket traced credential-stealing Python startup hooks in LiteLLM 1.107.0 wheels and container images. The investigation linked the payload to a lookalike source recorded in build provenance, while noting the workflow’s authorization and wheel-upload path remain unest

Key points

All seven LiteLLM 1.107.0 wheels contain cook.pth, cook.py, and sitecustomize.py; Python startup can trigger the payload without importing LiteLLM.
The collector targets cloud and developer credentials, private keys, browser data, AI-tool authentication files, and LiteLLM database credentials, then sends encrypted results to www[.]litellm[.]dev/healthcheck.
A separate loader polls a GitHub-hosted file and can download and execute Python without signature or content-hash verification. Its pointer returned an empty body during the investigation; that did not disable the collector.
Container provenance recorded the lookalike source Berri-AI/litellm and a revision containing the payload. The investigation says this does not establish how the source-owner override was authorized or whether the workflow uploaded the PyPI wheels.
Affected container tags included v1.107.0, latest, main-latest, and main-stable at the time of registry checks; additional images were reported by Upwind but not independently extracted for this article.
Operators are advised to stop deploying the release, investigate environments where Python ran, rotate potentially exposed credentials, and use reviewed artifacts with pinned container digests.

Article Details

Attack Vectors: LiteLLM 1.107.0 wheels install cook.pth, cook.py, and sitecustomize.py in Python's library directory; normal Python startup can execute the collector and launch a background loader.
The collector gathers cloud, developer, AI-tool, browser, private-key, and runtime credentials, encrypts the results, and POSTs them to hxxp://www[.]litellm[.]dev/healthcheck.
The background loader retrieves a pointer file from a GitHub repository and, when it supplies a suitable resolving domain, downloads and executes Python from that domain's /codepy path without signature or content-hash verification.
Container build provenance recorded the lookalike source repository Berri-AI/litellm; the recorded revision contains the same startup payload files as the inspected PyPI wheel.
Affected container tags included v1.107.0, latest, main-latest, and main-stable; the article reports that these tags resolved to the same image index at the observation time.
Defensive Notes: Block litellm==1.107.0 and stop deploying affected image tags or digests; check lockfiles, caches, build logs, container layers, and running image digests.
If Python ran after installation, isolate the affected host or container and treat secrets readable by that process as potentially exposed. Preserve process, filesystem, and network evidence before rebuilding.
Avoid starting the affected environment's Python or pip executable as the first remediation step; inspect it with trusted tooling.
Revoke and replace potentially exposed credentials from a clean environment. Removing the package does not reverse credential exposure or stop an already-running loader.
Hunt for the listed payload hashes, correlate them with Python execution, /tmp/remote_code_loader.lock, and the upload marker, and search egress logs for the /healthcheck destination, GitHub pointer path, and subsequent /codepy requests.
Review cloud, identity-provider, repository, and registry audit logs. An empty loader pointer or missing local marker does not rule out collection by the independent startup hook.
For release workflows, verify approved repository identities and reviewed revisions, audit the source_owner override and publishing permissions, and validate provenance against an expected source and builder policy.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`www[.]litellm[.]dev`	Exfiltration host receiving encrypted credential-collection results at its /healthcheck endpoint.
SHA256	`03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea`	Additional hash listed for the malicious cook.py collector.
SHA256	`0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a`	Hash of an affected LiteLLM 1.107.0 macOS wheel.
SHA256	`12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484`	Hash of an affected LiteLLM 1.107.0 Windows wheel.
SHA256	`1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e`	Affected GHCR container image index digest.
SHA256	`1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00`	Hash of an affected LiteLLM 1.107.0 musllinux x86-64 wheel.
SHA256	`34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa`	Hash of the malicious sitecustomize.py background-loader startup file.
SHA256	`462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7`	Hash of an affected LiteLLM 1.107.0 Linux x86-64 wheel.
SHA256	`56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf`	Affected Linux arm64 container image manifest digest.
SHA256	`668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6`	Hash of an affected LiteLLM 1.107.0 Linux aarch64 wheel.
SHA256	`7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d`	Hash of an affected LiteLLM 1.107.0 macOS wheel.
SHA256	`7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb`	Hash of the malicious cook.pth startup file.
SHA256	`84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d`	Additional hash listed for the malicious cook.pth startup file.
SHA256	`9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25`	Hash of the malicious cook.py collector.
SHA256	`b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465`	Additional hash listed for the malicious sitecustomize.py startup file.
SHA256	`bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5`	Affected Linux amd64 container image manifest digest.
SHA256	`c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054`	Hash of an affected LiteLLM 1.107.0 musllinux aarch64 wheel.
URL	`hxxp[:]//www[.]litellm[.]dev/healthcheck`	Exfiltration URL used by the collector to POST encrypted collection results.
URL	`hxxps[:]//github[.]com/Berri-AI/litellm`	Lookalike source repository recorded in the affected container build provenance and linked by the article to the malicious payload.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt`	Specific GitHub-hosted pointer URL queried by the background loader to obtain a remote-code destination.