Microsoft Details LiteLLM 1.107.0 Supply-Chain Compromise and Credential-Collection Payload

Oct 23, 2026 · Original article ↗

Summary

Microsoft analyzed compromised LiteLLM 1.107.0 packages that used Python startup hooks to collect credentials and attempt encrypted exfiltration. A separate Unix loader could fetch code, but second-stage execution was unconfirmed.

Key points

On Oct. 21, 2026, compromised LiteLLM 1.107.0 packages were published on PyPI and distributed in official container images; startup files could execute code when Python started, even without importing LiteLLM.
LiteLLM maintainers said stolen developer GitHub credentials were used to redirect the release workflow to lookalike Berri-AI/litellm; a credential tied to another developer account satisfied production approval. Microsoft did not determine how the attacker first accessed the upstream environment.
The PRIVCOLLECT payload was designed to target developer, cloud, browser, SSH and AI-tool credentials, plus selected LiteLLM proxy database fields. It encrypted collected data and attempted to upload it to hxxp://www[.]litellm[.]dev/healthcheck; listed targets do not establish successful access.
Microsoft endpoint observations on Windows and macOS matched the collector’s discovery, encryption and outbound-connection behavior. In one Windows example, starting Python to install an unrelated dependency activated the collector.
A separate Unix-oriented loader could read a GitHub-hosted pointer and retrieve and execute Python code. The pointer was empty when researchers examined it, and second-stage retrieval and execution were not confirmed.
Microsoft advises against running Python or pip in a suspect environment. It recommends external investigation, rebuilding and checking for leftover startup files, rotating reachable credentials, and correlating multiple evidence sources rather than treating package presence alone as proof of compromise.

Article Details

Attack Vectors: According to LiteLLM maintainers, stolen developer GitHub credentials were used to alter the release workflow to use the lookalike Berri-AI/litellm repository; a credential associated with another developer account was used for a production approval step. Microsoft did not determine how the credentials were obtained.
The compromised LiteLLM 1.107.0 package was distributed through PyPI and official container images. Its cook.pth and sitecustomize.py files enabled malicious code to run during Python startup without an application importing LiteLLM.
The PRIVCOLLECT collector gathered accessible credentials and sensitive data, encrypted the collection, and attempted to upload it to an attacker-controlled endpoint.
On Unix-based systems, a separate loader was designed to read a GitHub-hosted pointer, retrieve Python code from a remote server, and execute it. The pointer was empty when examined, and retrieval and execution were not confirmed.
Defensive Notes: Identify and contain every affected LiteLLM 1.107.0 installation, cache, package mirror, build output, and container image; verify artifacts against the published hashes.
Do not run Python, pip, or other commands that invoke the affected interpreter during investigation. Inspect affected environments from a known-clean system and check for cook.pth, cook.py, and sitecustomize.py in the environment library path.
Isolate affected workstations, build agents, test systems, containers, and gateway hosts; where safe, stop Python processes and prevent their restart.
Rebuild affected environments from verified artifacts rather than relying on removal of the LiteLLM application directory alone.
From a known-clean machine, rotate credentials accessible to affected identities, including cloud, workload, CI/CD, source-control, model-provider, SSH, GPG, browser-session, and AI coding-tool credentials. Revoke affected sessions as well.
Correlate file hashes, process ancestry, .pc_e_ staging, network destinations, workload identity, and subsequent cloud or identity activity; package presence or a generic filename alone is not a compromise verdict.
Use hash-pinned dependencies, verify package and image provenance, prefer immutable container digests, review packages before admitting them to internal mirrors, and restrict unnecessary outbound HTTP.
Enable supported Microsoft Defender protections and use the article's hunting queries and detections as investigation leads, not standalone verdicts.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`www[.]litellm[.]dev`	Listed as the exfiltration domain used by the compromised package's collector.
SHA256	`03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea`	SHA-256 hash of the cook.py Windows wheel variant identified as a compromised-package artifact.
SHA256	`0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a`	SHA-256 hash of the compromised LiteLLM 1.107.0 macOS arm64 wheel.
SHA256	`12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484`	SHA-256 hash of the compromised LiteLLM 1.107.0 Windows wheel.
SHA256	`1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00`	SHA-256 hash of the compromised LiteLLM 1.107.0 musllinux x86_64 wheel.
SHA256	`34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa`	SHA-256 hash of a sitecustomize.py variant identified as a compromised-package artifact.
SHA256	`462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7`	SHA-256 hash of the compromised LiteLLM 1.107.0 manylinux x86_64 wheel.
SHA256	`668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6`	SHA-256 hash of the compromised LiteLLM 1.107.0 manylinux aarch64 wheel.
SHA256	`7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d`	SHA-256 hash of the compromised LiteLLM 1.107.0 macOS x86_64 wheel.
SHA256	`7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb`	SHA-256 hash of the malicious cook.pth startup file.
SHA256	`84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d`	SHA-256 hash of a cook.pth variant identified as a compromised-package artifact.
SHA256	`9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25`	SHA-256 hash of a cook.py variant identified as a compromised-package artifact.
SHA256	`b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465`	SHA-256 hash of the sitecustomize.py Windows wheel variant identified as a compromised-package artifact.
SHA256	`c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054`	SHA-256 hash of the compromised LiteLLM 1.107.0 musllinux aarch64 wheel.
URL	`hxxp[:]//www[.]litellm[.]dev/healthcheck`	Collector upload endpoint identified as the exfiltration URL.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt`	Specific GitHub-hosted dead-drop URL read by the Unix loader for its mutable attacker-server pointer; the file was empty when examined.