Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

What happened

Someone put harmful code into LiteLLM version 1.107.0 on PyPI, the main site where Python packages are shared. The bad code runs every time any Python program starts on the computer, even if that program never uses LiteLLM. PyPI removed the release on October 21, 2026. Matching Docker images also carried the bad code for a few hours.

Key facts

• All seven wheel files (for Linux, macOS, and Windows) include the bad code.
• Three files are added to the install folder, called site-packages.
• Docker images were affected from 11:46 to 14:20 UTC.
• Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean.
• The packages that 1.107.0 depends on, litellm-proxy-extras 0.4.110 and litellm-enterprise 0.1.78, are also clean.

How the attack works

The attack has two parts. The first file, cook.py, is a credential stealer. It collects SSH keys, cloud logins, build-system secrets, AI tool tokens, browser passwords, and LLM provider keys. It scrambles the data and sends it to a lookalike domain, www.litellm[.]dev. The second file, sitecustomize.py, starts a hidden background program. Every hour, it checks a server address stored in a GitHub file, steals data again, and downloads and runs new code from that server.

How the bad code got in

One extra line was added to the project's build settings. That line tells the build tool to copy a hidden folder called cook into the package. The public source code on GitHub does not have this line or folder. The attacker had stolen GitHub login tokens from three developers. They also used a lookalike repository, Berri-AI/litellm, and got past an approval step using a second developer's credential. The official release system then built and signed the bad files.

Why it matters

LiteLLM is used to connect apps to AI services, so it often holds many secret keys. Because the bad code runs whenever Python starts, anyone who installed this version may have had passwords and keys stolen. Users should check whether they installed 1.107.0 or the affected Docker images, and treat any secrets on those machines as exposed.