LiteLLM 1.107.0 Compromise Delivered an Infostealer and RAT
Summary
Aikido reports that compromised LiteLLM 1.107.0 PyPI wheels and Docker images contained an infostealer and RAT. It details the build-time injection and credential theft; affected users are urged to rotate credentials after the release was removed and the incident was re
Key points
- Aikido reports that LiteLLM 1.107.0 Python wheels and Docker images were compromised; LiteLLM said the incident was contained.
- The article says an attacker used a maturin directive to bundle files created in a compromised build environment into compiled wheels, without changing the source repository.
- Injected cook.pth caused cook.py to run at Python startup; the infostealer collected credentials and secrets, including browser passwords, SSH keys, cloud credentials, and LiteLLM database contents.
- Injected sitecustomize.py launched a background RAT that periodically retrieved and executed Python code from attacker-controlled infrastructure.
- PyPI quarantined and removed version 1.107.0; the affected Docker image was also removed from Docker Hub and GHCR.
- The affected install and image-pull windows were October 21, 2026; users who ran or pulled the affected release are advised to assume credentials were compromised and rotate them.
Article Details
- Attack Vectors
- An attacker used the data = "cook" directive in LiteLLM's pyproject.toml to bundle files from a directory created in the compromised build environment into published version 1.107.0 wheels.
- The injected cook.pth caused cook.py to run whenever Python started, stealing credentials and other data from affected machines.
- The injected sitecustomize.py started a background daemon that retrieved a C2 domain and Python payload, then executed the payload with the privileges of the Python process.
- Defensive Notes
- Anyone who installed LiteLLM 1.107.0 or pulled the affected Docker or GHCR image during the stated time windows should treat credentials as compromised and rotate them.
- Check for /tmp/.pc_once_* and /tmp/remote_code_loader.lock; the article says these indicate the infostealer ran and the C2 daemon ran or may still be running, respectively.
- PyPI quarantined and removed version 1.107.0, and the affected Docker image was removed from Docker Hub and GHCR. LiteLLM reported that the incident was contained.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a | SHA-256 hash of a compromised LiteLLM 1.107.0 macOS arm64 wheel. |
| SHA256 | 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 | SHA-256 hash of a compromised LiteLLM 1.107.0 Windows wheel. |
| SHA256 | 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 | SHA-256 hash of a compromised LiteLLM 1.107.0 musllinux x86_64 wheel. |
| SHA256 | 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa | SHA-256 hash of the malicious sitecustomize.py RAT file injected into Python site-packages. |
| SHA256 | 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 | SHA-256 hash of a compromised LiteLLM 1.107.0 manylinux x86_64 wheel. |
| SHA256 | 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 | SHA-256 hash of a compromised LiteLLM 1.107.0 manylinux aarch64 wheel. |
| SHA256 | 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d | SHA-256 hash of a compromised LiteLLM 1.107.0 macOS x86_64 wheel. |
| SHA256 | 7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb | SHA-256 hash of the malicious cook.pth file injected into Python site-packages. |
| SHA256 | 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25 | SHA-256 hash of the malicious cook.py infostealer file injected into Python site-packages. |
| SHA256 | c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 | SHA-256 hash of a compromised LiteLLM 1.107.0 musllinux aarch64 wheel. |
| URL | hxxp[:]//www[.]litellm[.]dev/healthcheck | Attacker-controlled endpoint used by the infostealer to exfiltrate collected data. |
| URL | hxxps[:]//raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt | Specific attacker-used dead-drop URL from which the RAT retrieved its current C2 domain. |
MITRE ATT&CK
T1005 · Data from Local SystemThe infostealer collected local browser data, shell history, keys, configuration files, and the LiteLLM database.T1016 · System Network Configuration DiscoveryThe infostealer collected network-interface information from infected machines.T1041 · Exfiltration Over C2 ChannelThe infostealer exfiltrated collected data to its attacker-controlled HTTP endpoint.T1057 · Process DiscoveryThe infostealer collected information about running processes.T1059.006 · PythonThe injected infostealer and RAT execute Python code, including remotely fetched Python payloads.T1071.001 · Web ProtocolsThe RAT polled attacker infrastructure over HTTP, and the infostealer sent collected data via HTTP POST.T1082 · System Information DiscoveryThe infostealer collected host, username, and operating-system information.T1083 · File and Directory DiscoveryThe infostealer searched local files and directories for credentials, keys, configuration, and other data to collect.T1105 · Ingress Tool TransferThe RAT fetched its C2 domain and Python payload from remote infrastructure.T1195.002 · Compromise Software Supply ChainThe attacker abused LiteLLM's build configuration and compromised build environment to inject files into published Python wheels.T1546.017 · Udev RulesInjected .pth and sitecustomize.py files caused malicious code to run automatically at Python interpreter startup.T1552.001 · Credentials In FilesThe infostealer collected credentials from files and configurations, including cloud credentials, Git credentials, and CI/CD secrets.T1552.004 · Private KeysThe infostealer collected SSH private keys, GPG private keys, and TLS private keys from infected machines.T1552.005 · Cloud Instance Metadata APIThe infostealer queried AWS, GCP, and Azure instance metadata endpoints to obtain credentials available to the running instance.T1555.003 · Credentials from Web BrowsersThe infostealer retrieved saved passwords from Chromium-based browsers and saved credentials from Firefox.
Products
Dockerby an attacker who injected malicious code into its published Python wheels on PyPI. The official Docker image for the same version is also compromised.LiteLLMOn October 21, 2026, version 1.107.0 of LiteLLM (a popular open source proxy that lets developers route requests across dozens of LLM providers) was found to be compromised by an attacker who injected malicious code