LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor.

On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m. PST. The following compromised versions were published -

Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0, latest, main-latest, or main-stable between 11:46 a.m. and 2:20 p.m. UTC are impacted.

The poisoned version incorporated code to harvest credentials and keys, and run arbitrary code from a remote server every hour, turning it into a remote access trojan (RAT).

Specifically, the Python interpreter processes a path file ("cook.pth"), which includes a command to import "cook," a Python script ("cook.py") that deobfuscates itself and runs a stealer routine named "privcollect" to gather system, browser, developer, cloud, and AI tool secrets, and exfiltrate the data to "litellm[.]dev/healthcheck" via an HTTP POST request.

In addition, the interpreter attempts to execute "sitecustomize.py," which runs only on Linux and macOS machines, and is configured to fetch "domain.txt" from a now-removed GitHub dead drop ("github[.]com/letters9813"). Should this file return a valid response, the malware proceeds to download a second-stage Python script from "<domain>/codepy" and execute it.

lock' to prevent multiple instances, then enters an infinite loop," Aikido researcher Ilyas Makari said .

Source link