LiteLLM 1.107.0 PyPI compromise: credential stealer + RCE backdoor in official wheels
Severity: critical · Patch status: no-fix-needed · Since 2026-10-21
LiteLLM 1.107.0 published to PyPI on 2026-10-21 contained a credential stealer (cook.py, loaded via cook.pth) and an RCE backdoor (sitecustomize.py) injected into all seven wheels via a maturin 'data = cook' line absent from upstream GitHub source. Both payloads execute in every Python process on the host, even without importing litellm. The stealer harvests SSH keys, cloud/CI-CD credentials, browser passwords, AI tool tokens, and LiteLLM proxy database LLM keys, exfiltrating AES+RSA-encrypted archives to www.litellm[.]dev; the backdoor runs an hourly daemon fetching code from a GitHub raw URL. Attackers used stolen GitHub CLI credentials of three developers (believed taken from an internet-exposed internal LiteLLM deployment) to bypass branch protection, redirect the release workflow to lookalike repo Berri-AI/litellm, and pass approval, so artifacts were officially built and signed. PyPI removed the release by 13:23 UTC; Docker images carried the code 11:46–14:20 UTC. Versions 1.106.2, 1.107.0rc1/rc2 and companion packages are clean.
What to do
- Immediately check if litellm==1.107.0 was installed or the listed Docker images pulled between 11:46–14:20 UTC on 2026-10-21; quarantine and rebuild affected hosts and containers from clean images
- Rotate all credentials on affected hosts: SSH keys, cloud (AWS/Azure/GCP), Kubernetes, GitHub/GitLab tokens, CI/CD secrets, GPG/TLS keys, browser-saved passwords, and all LLM provider API keys including those in LiteLLM proxy databases
- Audit for persistence artifacts: cook.pth, cook.py, sitecustomize.py in site-packages, /tmp/.pc_once_72129118c59f5636c0bb, /tmp/remote_code_loader.lock, and outbound traffic to www.litellm[.]dev
- Pin to clean versions (1.106.2 or later fixed release) and verify wheel hashes/RECORD against upstream source before installing
- Block www.litellm[.]dev and the raw.githubusercontent.com/letters9813/pythonclient-test domain at network egress
- Review exposure of internal LiteLLM deployments and CI logging that may leak developer credentials
Fixed versions
- 1.106.2 (clean prior release); 1.107.0rc1/rc2 clean
Sources
All live incidents on Threat Watch
