LiteLLM 1.107.0 on PyPI stole credentials and planted a backdoor

If your team runs LiteLLM, open your package lock and check the version. SafeDep reports that a malicious release of LiteLLM, 1.107.0, was published to PyPI on 21 October and sat live for about two hours before the index removed it. It stole credentials on install and planted a backdoor.

Only 1.107.0 was compromised. SafeDep says the earlier 1.106.2 and the release candidates 1.107.0rc1 and 1.107.0rc2 were clean, and the companion packages that ship beside LiteLLM were not touched. The malicious wheels covered Linux, macOS and Windows, and the source distribution carried the same files, so a pip install on any of these platforms picked up the payload.

What the payload did

SafeDep's analysis names two files. cook.py, loaded through cook.pth, ran at the start of every Python process that imported anything from site-packages. It walked the disk for SSH keys, cloud credentials, CI and CD secrets, AI tool tokens and browser passwords, encrypted the result and sent it to www.litellm[.]dev/healthcheck. The second file, sitecustomize.py, spawned a detached daemon that polled a GitHub repository every hour for a server address, then downloaded and ran whatever code that server returned.

The post also writes that the wheels were built from an attacker-modified git source and contained a cook/ directory that is not in any public commit on the LiteLLM repository. SafeDep reads this as a compromise of the build pipeline, likely through stolen developer credentials, rather than a pull request slipped past review.

What a team should do now

The post lists indicators to check: the presence of cook.pth, cook.py or a modified sitecustomize.py under site-packages, lock files left behind under the user's home directory, and outbound connections to litellm[.]dev or to the GitHub repository the daemon polled. SafeDep says it is working with Berri AI to publish a fixed release and advises pinning to 1.106.2 or earlier until then. A machine that ran 1.107.0, even briefly, should be treated as reached: rotate every API key, SSH key, cloud credential and provider token the account could use, and read logs for the services tied to those keys.

This is the second supply chain attack on LiteLLM that the post names, after the compromise earlier in the year, and both reached a widely used LLM gateway rather than an obscure library. For any team using LiteLLM as a single front door to multiple model providers, that one box holds the keys to every provider at once, so the blast radius is the sum of every account the gateway can call.

Source

SafeDep: LiteLLM PyPI compromise, credential stealer and backdoor. Discussion on Hacker News.