LiteLLM 1.107.0 Compromised With Credential Stealer on PyPI and Docker
Wiz researchers found a trojanized version of the LiteLLM package that steals secrets and includes dormant command-and-control capabilities.
Key points
- Malicious LiteLLM version 1.107.0 was uploaded to PyPI and Docker registries on October 21.
- The package extracts scripts that steal browser, cloud, and AI credentials upon Python interpreter startup.
- PyPI quarantined the package hours after upload; the most recent safe version is v1.106.2.
Security researchers at Wiz identified a supply chain attack targeting the LiteLLM library on October 21. A malicious version 1.107.0 was published to the Python Package Index and Docker registries, introducing credential-stealing malware and dormant command-and-control functionality to unsuspecting users who installed the update.
The compromised package was uploaded to PyPI at 11:39 UTC on October 21. According to Wiz, the platform quarantined the malicious artifact by 1:20 UTC that same day. LiteLLM Docker containers hosted on GitHub Container Registry and Docker Hub also contained the trojanized code under tags including v1.107.0, latest, main-latest, and main-stable. The last known clean release remains version 1.106.2.
Malware Mechanics and Capabilities
Installing the malicious version extracts three files into the site-packages root directory: cook.pth, cook.py, and sitecustomize.py. These files are designed to execute automatically whenever a Python interpreter starts. The cook.pth file triggers the import of cook.py, which then deobfuscates itself and runs a stealer routine. This routine collects system, browser, developer, cloud, and AI tool secrets, encrypts them, and sends them to an attacker-controlled domain impersonating LiteLLM infrastructure.
The sitecustomize.py script attempts to run on Linux and macOS systems to fetch instructions from a GitHub repository. It looks for a file named domain.txt to determine where to download a secondary Python script. As of the time of analysis, that repository file was empty, and the GitHub repository was taken down by 1:30 PM UTC. The /tmp/ marker file creation fails on Windows systems, limiting some aspects of the infection chain on that platform.
Impact and Affected Systems
The attack targets users of the LiteLLM library, which is used to interact with various large language model APIs. The stealer routine specifically looks for credentials related to AI tools, cloud services, and web browsers. Because the malware executes on interpreter startup, any environment running the compromised package version is at risk of having its secrets exfiltrated to the www.litellm.dev/healthcheck endpoint, which is controlled by the attackers.
What should you do?
Organizations using LiteLLM should verify their installed versions immediately. If version 1.107.0 is present, it should be removed and replaced with the last known safe version, v1.106.2. Users should also check their Docker containers for the affected tags. Since the malware exfiltrates credentials, any secrets accessed by systems running the compromised package should be considered compromised and rotated.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: LiteLLM
- Audit your Python environments and Docker containers to confirm you are not running LiteLLM version 1.107.0 or the affected Docker tags.
- Rotate any API keys, cloud credentials, or AI tool secrets that may have been accessible to systems running the compromised package.
- Monitor network logs for outbound connections to the attacker-controlled domain www.litellm.dev or any unusual POST requests to healthcheck endpoints.
- Review installation logs for unexpected file extractions in site-packages directories, such as cook.pth or sitecustomize.py, which are not part of the legitimate library.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which version of LiteLLM is safe to use?
The most recent safe version is v1.106.2. Version 1.107.0 is confirmed malicious and should be avoided.
Did the attackers successfully download a second-stage payload?
The second-stage download mechanism relied on a GitHub file that was empty at the time of analysis, and the repository was subsequently taken down.
How long was the malicious package available on PyPI?
The package was uploaded at 11:39 UTC and quarantined by 1:20 UTC on October 21, meaning it was available for approximately thirteen hours.
