MAL 2026 2144

osv.dev • October 22, 2026

litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.

cook.pth contains import cook .

cook.py runs exec(zlib.decompress(base64.b64decode(...))) , an info stealer (self-named "privcollect") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to . It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.

sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from , then downloads and executes code from (remote shell / dropper).

The same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.

-= Per source details. Do not edit below this line.=-

Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)

LiteLLM was compromised through trivy security scan in a GitHub workflow. Attackers uploaded malicious versions of LiteLLM to PyPI. The malicious code would exfiltrate sensitive secrets to an attcker controlled domain.

Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)

The OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.

It is considered malicious because:

The package executes one or more commands associated with malicious behavior.

OpenSSF: Package Analysis - FINDER

Timothe Boulet - REPORTER

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

LiteLLM 1.107.0 Compromised: Credential Stealer and RAT Distributed via PyPI On October 21, 2026, the LiteLLM Python package version 1.107.0 was compromised in a supply chain attack, distributing malware that includes a credential stealer and a remote access trojan (RAT). The malicious code was injected into the package's wheels on PyPI and Docker images, affecting all platforms. The attack exploited a vulnerability in the build process, allowing attackers to add files that execute automatically when Python starts, even if LiteLLM is not explicitly imported. The compromised version has since been quarantined on PyPI, and the Docker images have been removed. Users who installed this version should assume their credentials are compromised and take immediate action to rotate secrets. This incident marks the second compromise of LiteLLM in 2026, following a previous incident in March. Investigations are ongoing to determine how the attack was executed and to secure the development environment. 18 sources 72

Extracted Entities

MAL 2026 2144

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

Domains (2)

IP Addresses (2)

MITRE ATT&CK (2)

Platforms (1)

SHA256 Hashes (2)

Tools (2)