LiteLLM 1.107.0 Compromised: Credential Stealer and Backdoor Analysis

Incident Overview

On October 21, 2026, the LiteLLM package version 1.107.0 on PyPI was found to contain malicious code designed to steal sensitive developer credentials and establish a persistent remote code execution (RCE) backdoor. The malicious files were injected into the build process, meaning the source code on GitHub remained clean, while the distributed wheels contained the payload. PyPI has since removed the compromised version.

Attack Mechanics

The attack utilized a sophisticated supply chain injection. By modifying the pyproject.toml file in a private build pipeline, the attacker ensured that three malicious files were included in the final Python wheels:

• cook.pth and cook.py: These files act as a credential stealer. Because Python automatically executes .pth files at startup, this code runs in every Python process on the host, including IDEs, CI/CD pipelines, and background tasks. It harvests SSH keys, cloud provider credentials (AWS, Azure, GCP), browser passwords, and LLM API keys, exfiltrating the data to www.litellm[.]dev.
• sitecustomize.py: This file implements a background daemon that persists on the host. It periodically checks a remote GitHub repository for a command-and-control server address, allowing the attacker to download and execute arbitrary second-stage code on the victim's machine.

Compromise of the Build Pipeline

Security analysis by SafeDep indicates that the malicious wheels were built using BerriAI’s internal release pipeline rather than a public GitHub Action. The attacker likely compromised maintainer credentials or the pipeline infrastructure itself to inject the cook/ directory and modify the build configuration. Because the malicious files were added during the wheel-building process, the RECORD files in the distribution correctly accounted for them, making the package appear legitimate to automated integrity checks.

Community Response and Mitigation

This incident marks the second time this year that LiteLLM has faced a supply chain compromise, leading to significant concern regarding the project's security posture and maintainer practices.

• Immediate Action: Users are advised to pin their LiteLLM dependencies to version 1.106.2 or earlier.
• Official Guidance: The LiteLLM team has published an official incident report at docs.litellm.ai/blog/security-incident-oct-21-2026 confirming the containment of the incident.
• Developer Sentiment: Community members have expressed frustration over the recurring nature of these vulnerabilities. Many are calling for improved package management security, such as default "cooldown" periods for new package versions and the use of sandboxing tools to limit the blast radius of third-party dependencies.

"Attackers compromised 3 unique developer github credentials is a little scary; this seems systemic - if three developers had their keys stolen, it implies the real problem is elsewhere. They revoked all but one developers, which is probably the right approach, but I'd pin LiteLLM to 'something before this version' and keep it there until further notice!" — HN Commenter @threecheese

"All the sandbox-exec and all the Lulu rules are not going to protect against something like this. At one point permission pop-up fatigue sets in we start giving any permission as if it's normal." — HN Commenter @crossroadsguy