Malicious LiteLLM 1.107.0 Wheel Steals Credentials and Installs a Persistent Backdoor

Summary

Analysis of the LiteLLM 1.107.0 macOS wheel found Python startup hooks that steal credentials and run a persistent remote-code loader. Upwind reported the payload in all seven wheels; the second stage remains unresolved.

Key points

The analyzed macOS x86-64 wheel contains cook.pth, cook.py and sitecustomize.py; the article says all seven LiteLLM 1.107.0 PyPI wheels contain the same injected files, per Upwind.
Python startup can trigger the payload without an application importing LiteLLM. It collects credentials and secrets, encrypts them, and sends them to www[.]litellm[.]dev/healthcheck over HTTP.
A detached loader retrieves domain.txt from raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt, then fetches and executes Python code from the supplied host’s /codepy path hourly.
The current second-stage domain and payload were not retrieved. Upwind reportedly said domain.txt had been empty since October 20, 2026; the article says it did not independently verify that history.
The operator panel at www[.]litellm[.]dev appears to contain victim information, but the article says its analysis is ongoing.
The researchers do not attribute the October compromise to TeamPCP or another actor; how the build environment or publishing credential was compromised remains unknown.
Recommended response includes isolating affected environments, investigating relevant Python and network activity, rotating secrets accessible to affected accounts, reviewing audit logs, and rebuilding from trusted artifacts.

Article Details

Attack Vectors: Compromised LiteLLM 1.107.0 macOS x86-64 PyPI wheel contains cook.pth, cook.py, and sitecustomize.py, which execute automatically during Python startup.
The credential-stealing payload collects browser credentials, keys, cloud and development secrets, environment variables, and other host information, then encrypts and uploads the collected data.
A detached background process retrieves mutable domain configuration and repeatedly downloads and executes Python code from a remote /codepy endpoint.
Defensive Notes: Treat systems where Python started after the wheel was installed as potentially compromised; isolate affected hosts, containers, virtual environments, workstations, and CI runners.
Search historical DNS, proxy, firewall, and HTTP telemetry for www.litellm.dev, especially POST /healthcheck and the reported X-Token header; also look for retrieval of the specified GitHub domain.txt path followed by Python requests to /codepy.
Preserve relevant artifacts and telemetry. Remove the malicious files from every affected site-packages directory from a shell, then terminate the detached loader process; starting Python during remediation can trigger the payload again.
Treat secrets accessible to affected accounts as compromised, rotate them from a known-clean system, review relevant audit logs, and rebuild affected environments from trusted artifacts.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`www[.]litellm[.]dev`	Host used as the credential-exfiltration receiver and reported to appear to host an operator panel; the panel observation remains under investigation.
SHA256	`20a59e5a285799e7cf7fa16cfba1c1414f1e84a8459e14207cfd4e998c2cd24b`	SHA-256 of the decoded credential-stealing payload from sitecustomize.py.
SHA256	`34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa`	SHA-256 of sitecustomize.py, which contains a stealer variant and persistent remote-code loader.
SHA256	`6ea3d8ef6cf73a72d8df24f663b7a31ce67494eeb9b0d707b93484e66675d2df`	SHA-256 of the decoded credential-stealing payload from cook.py.
SHA256	`7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d`	SHA-256 of the malicious LiteLLM 1.107.0 macOS x86-64 wheel.
SHA256	`7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb`	SHA-256 of the malicious cook.pth file in the analyzed wheel.
SHA256	`9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25`	SHA-256 of cook.py, which decodes and executes the credential-stealing payload.
URL	`hxxp[:]//www[.]litellm[.]dev/healthcheck`	Hard-coded HTTP endpoint used to upload encrypted credential bundles.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt`	Remote configuration URL the persistent loader retrieves to obtain a hostname for its second-stage request.
URL	`hxxps[:]//www[.]litellm[.]dev`	HTTPS site on the reported C2 host that appears to contain an operator panel with victim information; this observation is not yet confirmed.