LiteLLM: malicious 1.107.0 release on PyPI/Docker steals credentials and includes dormant C2
Severity: critical · Patch status: no-fix-needed · Since 2026-10-21
On 2026-10-21 a malicious version 1.107.0 of LiteLLM was published to PyPI and Docker Hub/GHCR via a compromised release pipeline. Attackers used stolen GitHub CLI OAuth tokens—apparently harvested from logs of an internet-exposed LiteLLM internal deployment—to push commits from a lookalike Berri-AI repo and trigger/approve a release. The payload installs cook.pth, cook.py and sitecustomize.py that run on interpreter startup, harvesting browser, cloud (AWS/GCP/Azure), SSH/GPG and AI-provider credentials, querying the LiteLLM PostgreSQL credentials table, and exfiltrating AES-encrypted data to www.litellm[.]dev/healthcheck; a dormant second-stage C2 via GitHub dead drop was never activated. Anyone who installed 1.107.0 or pulled affected Docker tags is affected. Malicious PyPI version quarantined ~13:20 UTC, Docker images removed ~13:53 UTC; tokens revoked; last safe version is v1.106.2.
What to do
- Assume credential compromise if LiteLLM 1.107.0 was installed or affected Docker tags pulled: rotate all LLM provider API keys (OpenAI, Anthropic, Cohere, etc.), cloud credentials (AWS/GCP/Azure), SSH/GPG keys, and browser passwords/cookies on affected hosts
- Downgrade/pin to v1.106.2 and verify site-packages for cook.pth, cook.py, sitecustomize.py and /tmp/.pc_once_* markers; check logs and egress for connections to www.litellm[.]dev
- Audit LiteLLM Proxy PostgreSQL LiteLLM_CredentialsTable access and rotate all stored provider keys
- Check whether any second-stage was fetched from the GitHub dead-drop domain (letters9813/pythonclient-test) and inspect for post-exploitation
- Review exposure of internal LiteLLM deployments and log redaction of tokens in proxied response bodies
Fixed versions
- v1.106.2 (last known safe)
Sources
All live incidents on Threat Watch
