Attackers hijacked the release process of LiteLLM, one of the most widely used open-source tools for connecting apps to AI models, and used it to ship a booby-trapped version to PyPI and to the project's official Docker images. Anyone who installed or pulled the poisoned build on October 21 should assume that every secret on that machine is now in someone else's hands.
What happened
LiteLLM is a Python SDK and AI gateway that lets developers talk to dozens of large language model providers through a single API. BleepingComputer counts roughly 92 million monthly PyPI downloads and more than 61,000 GitHub stars.
According to the project's own incident report, its release pipeline was compromised early on Tuesday, October 21, and a malicious version 1.107.0 was pushed out. The maintainers say the tainted artifacts were built from a repository controlled by the attacker, and that the official 1.107.0 source tag on GitHub does not contain the malicious files. Security vendors flagged the release within minutes, and it was pulled the same morning. LiteLLM says the incident is contained and that customers on its private enterprise release were not affected.
Who is affected
The exposure windows published by LiteLLM (all times UTC on October 21) are:
- PyPI: all seven wheels of litellm==1.107.0, live from 11:39 to 13:23 (7:39 to 9:23 AM EDT).
- Docker Hub: the tags v1.107.0, latest, main-latest and main-stable pointed to the compromised image from 11:46 to 14:20 (7:46 to 10:20 AM EDT).
- GitHub Container Registry: the same four tags for the litellm, litellm-database and litellm-non_root images were compromised from 11:46 until 13:51 (9:51 AM EDT).
Teams that deploy from a floating tag such as "latest" are at particular risk, since an automated pull in that window would have fetched the bad image silently. Every earlier release is described as safe. This is also the second time this year LiteLLM has been hit by a supply-chain attack; in March, malicious versions were published after the TeamPCP group breached the Trivy scanner used in the project's CI/CD pipeline. Datadog says no link between the two incidents has been established.
How the malware works
The attacker left LiteLLM's application code alone and instead tampered with the packaging. Aikido's analysis says a build directive in the project's configuration was abused to bundle an extra folder into the compiled wheels. On installation, three files land in Python's site-packages directory: cook.pth, cook.py and sitecustomize.py.
Python automatically processes .pth files and imports sitecustomize every time the interpreter starts, so the malware runs whenever any Python process launches in that environment, even if LiteLLM itself is never imported. Even running python or pip to investigate triggers it again.
- cook.py is an obfuscated infostealer. It hunts for AWS, Azure, Google Cloud, Kubernetes and Docker credentials; Git, GitHub, npm, PyPI and CI/CD tokens; .env files; SSH, GPG and TLS keys; AI tool credentials and LiteLLM's stored provider keys; browser logins, cookies and payment data; plus environment variables and shell history. The haul is encrypted with AES-256 and RSA-4096 and sent to the lookalike domain litellm[.]dev.
- sitecustomize.py is a backdoor. It spawns a background process that checks a file on GitHub every hour for a domain, then downloads and runs Python code from it. Datadog reports that the file only ever held test values, so no second-stage payload was seen, and GitHub has since removed the repository.
There is no CVE for this incident, because it is a compromised build rather than a bug in LiteLLM's code.
What you should do
- Check your installs. Search lock files, virtual environments, container images and CI logs for litellm 1.107.0 or any pull of the affected Docker tags during the windows above.
- Look for indicators. Researchers point to cook.pth, cook.py and sitecustomize.py in site-packages, and to /tmp/.pc_once_* and /tmp/remote_code_loader.lock files. Inspect suspect systems without starting their Python interpreter.
- Isolate and rebuild. Take affected hosts offline and rebuild them from known-good backups or images. Simply uninstalling the LiteLLM package can leave the startup files and a running loader behind.
- Rotate everything. Treat every credential reachable from the machine as stolen: cloud keys, AI provider API keys, tokens, SSH keys and saved browser passwords.
- Pin a clean version. LiteLLM recommends version 1.106.2, the last clean release before the attack. Pin exact versions or image digests rather than relying on floating tags.
0 Comments