Compromised LiteLLM 1.107.0 Releases Deliver Credential-Stealing Malware
Summary
Attackers compromised LiteLLM’s release pipeline and distributed malicious PyPI 1.107.0 wheels and Docker images for Windows, Linux, and macOS. The payload stole credentials and secrets; affected users are advised to isolate systems and rotate exposed secrets.
Key points
- LiteLLM’s maintainer says the release pipeline was compromised on October 21, and version 1.107.0 was pushed to PyPI and container registries. All seven PyPI wheels and several Docker and GHCR tags were affected.
- The attacker modified the installation package, adding cook.pth, cook.py, and sitecustomize.py. Python processes executable .pth lines and imports sitecustomize during startup, so launching Python or pip in an affected environment could trigger the malware.
- Researchers said the payload targeted cloud, Kubernetes and Docker credentials; AI tool and provider credentials; developer secrets and private keys; browser data; environment variables; and system information.
- Stolen data was encrypted with AES-256-CBC, with the key encrypted using RSA-4096, then uploaded to litellm[.]dev/healthcheck.
- A detached loader launched by sitecustomize.py checks a GitHub-hosted pointer hourly and downloads Python from an external server for execution on the host.
- The malicious packages have been removed. The project recommends LiteLLM 1.106.2 as the latest clean release; affected users should stop deployments, inspect environments without launching Python, isolate and rebuild infected systems, and rotate exposed secrets.
Article Details
- Victim Organization
- LiteLLM project
- Incident Type
- Software supply-chain compromise; malicious LiteLLM packages and Docker images distributed with credential- and data-stealing malware
- Incident Date
- 2026-10-21
- Disclosure Date
- 2026-10-22
- Data Types Exposed
- Cloud and deployment credentials
- AI provider credentials and configuration
- Developer credentials and secrets
- SSH, GPG, and TLS keys
- Browser logins, cookies, autofill/payment data, and browsing history
- Environment variables
- Shell and application histories
- System and network information
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- All seven PyPI wheels for LiteLLM 1.107.0 and specified Docker Hub and GHCR image tags pointed to compromised artifacts for limited periods. The payload executed during Python startup and could steal data from affected environments. The article does not report a confirmed number of affected installations or stolen-data volume.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e | SHA-256 digest of a Docker image index identified by the maintainer as compromised. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collected data from local host files and browser databases.T1041 · Exfiltration Over C2 ChannelThe malware uploaded stolen data to the reported healthcheck endpoint.T1059.006 · PythonThe payload used Python startup files and downloaded Python for execution.T1105 · Ingress Tool TransferA detached loader downloaded Python from an external server.T1552.001 · Credentials In FilesThe malware targeted credentials and secrets in files, including .env files.T1555.003 · Credentials from Web BrowsersThe malware targeted saved browser logins and other browser data.
Products
Docker HubDocker Hub: v1.107.0, latest, main-latest, and main-stable: pointed to compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTCLiteLLMLiteLLM release pipeline hacked to distribute info-stealer malwarePyPIHackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.