Malicious LiteLLM 1.107.0 Release Steals Credentials via Python Startup Hooks
Attackers used stolen tokens to push a backdoored LiteLLM version that installs credential stealers, affecting cloud and AI keys across major platforms.
Key points
- Malicious LiteLLM v1.107.0 was published on October 21, 2026, and remained available for approximately two hours before removal.
- The payload installs persistent Python hooks that steal credentials even if the LiteLLM library is never imported by the application.
- Attackers used stolen GitHub CLI tokens from three engineers to trigger the build pipeline using a lookalike repository named Berri-AI/litellm.
Attackers published a malicious version of the LiteLLM Python proxy library on October 21, 2026. The compromised release, version 1.107.0, was distributed through PyPI and official Docker container registries before being removed after roughly two hours, according to Datadog Security Labs research.
The malicious package installs credential-stealing malware that activates whenever the Python interpreter starts. This behavior occurs regardless of whether the application code explicitly imports LiteLLM. The payload includes a backdoor that checks for remote commands, though no second-stage execution was observed in the wild during the investigation.
Attack Methodology and Build Compromise
Datadog researchers found that attackers used stolen GitHub CLI OAuth tokens from three engineers to manipulate LiteLLM’s private release workflow. These credentials allowed the threat actors to launch, approve, and later delete evidence of an unauthorized build run. The build process targeted a malicious fork called Berri-AI/litellm, which differs from the legitimate BerriAI/litellm repository by a single hyphen.
According to GBHackers, Socket researchers flagged seven malicious wheels about seven minutes after publication. The compromised distributions covered macOS, Linux, and Windows platforms. Container build provenance records showed the source owner was overridden to select the hyphenated organization, masking the malicious origin behind seemingly legitimate build metadata.
Credential Exposure and Payload Details
The malware installs three files into the Python site-packages directory: cook.pth, cook.py, and sitecustomize.py. The cook.py script collects sensitive data and encrypts it using AES-256 and RSA-4096 before sending it to a lookalike domain. The sitecustomize.py file acts as a remote access trojan, checking a GitHub repository for command domains.
Targeted credentials include AWS, Azure, and Google Cloud access keys, as well as Kubernetes and Docker secrets. The stealer also harvests SSH keys, Git tokens, and environment variables. AI-specific targets include API keys and sessions for Claude, Codex, Gemini, Cursor, and Copilot. If a LiteLLM proxy database is configured, the malware queries tables storing upstream provider credentials.
What should you do?
Datadog Security Labs advises users to manually remove the malicious cook.pth, cook.py, and sitecustomize.py files from their site-packages directories. Simply deleting the litellm package directory does not remove these persistent hooks. Users should revert to version 1.106.2, the latest safe release, and rotate all potentially exposed credentials from a clean machine.
Background: OAuth
The difference between OAuth and API key lies in identity and scope. An API key acts as a static password identifying a project or client to a system. OAuth is an authorization framework that allows third-party applications to obtain limited access to user accounts without exposing credentials.
Read the full guide: Difference Between OAuth and API Key and How to Choose
What to do and how to stay safe: LiteLLM
- Scan Python site-packages directories for unauthorized .pth or sitecustomize.py files that execute external code or collect data.
- Audit cloud provider logs and AI service access records for unusual activity during the two-hour exposure window of October 21, 2026.
- Rotate all API keys, SSH keys, and cloud credentials that may have been accessible to Python processes running on affected systems.
- Monitor build pipeline logs for unauthorized source overrides or lookalike repository references in future software releases.
Step-by-step guide: Cloud Misconfiguration Response: Containment, Recovery and Prevention Steps
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does removing the LiteLLM package fix the infection?
No, removing the litellm package directory does not delete the malicious cook.pth, cook.py, or sitecustomize.py files, which remain in the site-packages directory.
How did attackers bypass the build security?
Attackers used stolen GitHub CLI OAuth tokens from three engineers to approve and launch a build workflow pointing to a lookalike repository.
Was the backdoor actively used to download more malware?
No, the remote command file only contained test values, and no second-stage payload was observed in the wild during the investigation.
