Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.
The supply-chain attack affected all PyPI wheels (.whl installation packages) for LiteLLM version 1.107.0, impacting Windows, Linux, and macOS systems.
LiteLLM is an open-source Python SDK and AI gateway that enables applications to access AI models from different providers through a common API.
It is a massively popular project with 61,800 GitHub stars, 92 million monthly downloads on PyPI, and is used by high-profile companies like NVIDIA, Netflix, AT&T, and Okta.
The project says that the release pipeline was compromised on October 21 and a threat actor pushed version 1.107.0 to the Docker registry and PyPI.
"This version contained compiled malware which steals credentials and loads remote-code execution tools," the maintainer says, adding that customers running the private enterprise were not impacted.
In a post-mortem of the incident, the maintainer says that the following LiteLLM artifacts were affected in the attack:
- PyPI: litellm==1.107.0: all seven wheels, live from 11:39:51 to 13:23 UTC
- Docker Hub: v1.107.0, latest, main-latest, and main-stable: pointed to compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTC
- GHCR: v1.107.0, latest, main-latest, and main-stable: pointed to the compromised image indexes below from 11:46:56 UTC until they were made unavailable by 13:51 UTC
-
- ghcr.io/berriai/litellm: sha256:1bbcb1443bc9…
- ghcr.io/berriai/litellm-database: sha256:c00f9d92c427…
- ghcr.io/berriai/litellm-non_root: sha256:7b00e91cd2fe…
Multiple application security companies detected the attack within six minutes of publishing the malicious LiteLLM version and analyzed the payload.
According to the researchers, the attacker did not touch the LiteLLM application code and modified only the installation package to place three malicious files (cook.pth, cook.py, and sitecustomize.py) in the environment's Python’s library directory.
"During normal startup, Python processes executable .pth lines and then attempts to import sitecustomize," Socket researchers explain.
Endor Labs notes that this way the payloads are executed before the application every time Python is launched in the environment. Running Python or pip to investigate an affected installation also triggered the malware.
The malware targeted the following data:
- Cloud and deployment credentials: AWS, Azure, Google Cloud, Kubernetes, Docker, and infrastructure-management secrets.
- AI credentials and configuration: Authentication files for AI development tools, plus LiteLLM’s stored provider credentials and model settings.
- Developer secrets and private keys: Git, GitHub, npm, PyPI, and CI/CD credentials; .env files; SSH, GPG, and TLS keys.
- Browser data: Saved login, cookie, autofill/payment, and browsing-history databases.
- Host and runtime data: Environment variables, shell and application histories, and system and network information.
The stolen data is encrypted using an AES-256-CBC key that is encrypted with an RSA-4096 key and then uploaded to ‘litellm[.]dev/healthcheck’
One of the malicious files, sitecustomize.py, launches a detached loader that checks a GitHub-hosted pointer every hour and downloads Python from an external server for execution on the host.
The malicious packages have been removed, but potentially impacted users should stop affected deployments and inspect environments without launching the Python interpreter.
Infected systems should be isolated and rebuilt from clean backups, and all exposed secrets should be rotated immediately.
Removing the LiteLLM package directory alone may leave startup files or an active loader behind.
Currently, the recommended recovery version is LiteLLM 1.106.2, which is the latest clean release before the attack.
Previously, the project also suffered a breach in March, when the TeamPCP hacking group published malicious LiteLLM versions on PyPI after breaching Aqua Security's Trivy vulnerability scanner used in LiteLLM's CI/CD pipeline.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.