Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
- ID
- 38072
- Status
- summarized
- Published
- 21 Oct 2026, 10:00 PM
- Fetched
- 22 Oct 2026, 5:17 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 9.1
- Created
- 22 Oct 2026, 5:18 AM
- Tags
- Audience
- developersai_ml_learnersai_agent_usersvibe_coderssaas_founders
What happened
LiteLLM 1.107.0 on PyPI shipped with three malicious files in site-packages across all seven wheels (Linux, macOS, Windows): cook.pth, which imports cook.py and runs on every Python interpreter start — even in processes that never import litellm — harvesting SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and the LLM provider keys stored in a LiteLLM proxy database, encrypting them and posting to www.litellm[.]dev; and sitecustomize.py, which launches a daemon that hourly re-reads a server address from a GitHub file, re-runs the stealer and executes downloaded code. The upstream GitHub source does not contain the implant, and PyPI has since removed the release. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean, as are the pinned companions litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78.
Why it matters
If anyone on your team ran `pip install litellm==1.107.0` — including transitively via a lockfile or a Docker base image — assume the host is compromised at the interpreter level, not the app level: the .pth hook fires before your code runs, so every venv and every Python process on that machine leaked its env vars and ~/.ssh keys. Actions: grep site-packages for cook.pth, cook.py and sitecustomize.py, pin litellm to 1.106.2 (or a verified newer release) and rebuild images rather than patching in place, then rotate the LiteLLM proxy master key and virtual keys, cloud IAM keys, CI secrets and any AI provider API keys that ever sat on that machine. Also check outbound traffic to www.litellm[.]dev and to the GitHub-hosted address file to scope the hourly daemon.
Discussion angle
The nasty part isn't the stealer, it's the delivery: a .pth file runs at interpreter startup, so one `pip install` poisons the whole host regardless of which app imports litellm. Worth asking the room whether their dependency scanning covers .pth and sitecustomize.py at all, and whether lockfiles plus hash pinning would actually have stopped this.