Malicious LiteLLM 1.107.0 Release Steals Credentials and Adds RAT Backdoor

Summary

A malicious LiteLLM 1.107.0 release on PyPI and Docker images ran a Python-startup credential stealer and RAT loader. Attackers reportedly used stolen GitHub CLI OAuth tokens; the release was removed, and Datadog urges affected users to clean environments and rotate

Key points

Malicious version 1.107.0 was published to PyPI and official Docker images on October 21, 2026; it was available for about two hours.
According to LiteLLM's analysis, stolen GitHub CLI OAuth tokens from three engineers were used to run the private release workflow against a malicious, lookalike fork.
The release added cook.pth, cook.py, and sitecustomize.py, causing the malware to run whenever Python starts, even if LiteLLM is not imported.
The stealer targeted cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, sending stolen data to www[.]litellm[.]dev/healthcheck.
A second-stage RAT loader checked a GitHub-hosted file hourly and could download and run Python code; the file contained only test values, and no second-stage payload was observed in the wild.
Deleting the LiteLLM package alone does not remove the dropped files. Guidance includes manually removing them, reverting to 1.106.2, rotating exposed credentials from a clean machine, and auditing logs.
The initial compromise of the engineers' credentials was unknown at publication; no connection to LiteLLM's earlier 2026 compromise had been established.

Article Details

Attack Vectors: Attackers used stolen GitHub CLI OAuth tokens from three engineers' accounts to launch LiteLLM's private release workflow against a malicious lookalike fork, Berri-AI/litellm.
The malicious release added cook.pth, cook.py, and sitecustomize.py to Python's site-packages; Python automatically runs the payload when the interpreter starts.
The credential stealer collected cloud, developer, AI-tool, browser, and LiteLLM proxy credentials, encrypting and sending them to a lookalike domain.
A backdoor periodically checked a GitHub-hosted file for a domain, then downloaded and ran Python code from that domain. The file held only test values, and no second-stage payload was observed in the wild.
Defensive Notes: Manually remove cook.pth, cook.py, and sitecustomize.py from the site-packages directory; deleting the litellm package directory alone does not remove them.
Remove code and data associated with litellm==1.107.0 and revert to litellm==1.106.2, identified as the latest safe version.
From a clean machine, rotate affected credentials and audit relevant logs for use of exposed credentials during the exposure window.
Lock release workflows to approved repositories and restrict which branches can be built; treat developer CLI tokens as high-value secrets.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`litellm[.]dev`	Lookalike exfiltration domain receiving credentials collected by the stealer.
SHA256	`0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a`	Hash of a malicious LiteLLM macOS ARM64 wheel.
SHA256	`12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484`	Hash of a malicious LiteLLM Windows x86-64 wheel.
SHA256	`1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e`	Hash of the infected LiteLLM image index.
SHA256	`1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00`	Hash of a malicious LiteLLM musllinux x86-64 wheel.
SHA256	`462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7`	Hash of a malicious LiteLLM manylinux x86-64 wheel.
SHA256	`668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6`	Hash of a malicious LiteLLM manylinux ARM64 wheel.
SHA256	`7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d`	Hash of a malicious LiteLLM macOS x86-64 wheel.
SHA256	`c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054`	Hash of a malicious LiteLLM musllinux ARM64 wheel.