LiteLLM PyPI Package Hacked to Spread Credential-Stealing Malware

Hackers compromised the LiteLLM project’s PyPI package and published a malicious Docker image containing malware designed to steal credentials, secrets, and environment variables.

The software supply chain attack affected every PyPI wheel (.whl installation package) for LiteLLM version 1.107.0, potentially impacting Windows, Linux, and macOS systems.

LiteLLM is an open-source Python SDK and AI gateway that lets applications access AI models from different providers through a common API.

The project has 61,800 GitHub stars, 92 million monthly PyPI downloads, and is used by companies including NVIDIA, Netflix, AT&T, and Okta.

LiteLLM version 1.107.0 was compromised

According to the project’s security incident report, an attacker pushed LiteLLM version 1.107.0 to Docker registries and PyPI on October 21.

“This version contained compiled malware that stole credentials and loaded remote code execution tools,” the project administrator said, adding that customers operating private companies were not affected.

The project identified the following compromised LiteLLM artifacts:

• PyPI: litellm==1.107.0. All seven wheels were available from 11:39:51 to 13:23 UTC.
• Docker Hub: The v1.107.0, latest, main-latest, and main-stable tags pointed to the compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTC.
• GHCR: The v1.107.0, latest, main-latest, and main-stable tags pointed to a compromised image index from 11:46:56 UTC until it became unusable at 13:51 UTC.

The affected GHCR images included:

• ghcr.io/berriai/literllm: sha256:1bbcb1443bc9…
• ghcr.io/berriai/litellm-database: sha256:c00f9d92c427…
• ghcr.io/berriai/litellm-non_root: sha256:7b00e91cd2fe…

Malware used Python startup hooks to steal secrets

Multiple application security companies detected the attack and analyzed the malicious payload within six minutes of the compromised LiteLLM version being released.

Researchers said the attackers did not modify LiteLLM’s application code. Instead, they changed the installation package and added three malicious files to the environment’s Python library directory:

• cook.pth
• cook.py
• sitecustomize.py

As Socket researchers explained, “During normal startup, Python processes executable .pth lines and attempts to import sitecustomize.”

Endor Labs noted that these startup hooks caused the payload to run before an application every time Python started in the affected environment. The malware was triggered when users ran Python or pip to investigate the compromised installation.

What information did the LiteLLM malware target?

The malware targeted a broad range of credentials, secrets, browser data, and host information, including:

• Cloud and deployment credentials: AWS, Azure, Google Cloud, Kubernetes, Docker, and infrastructure management secrets.
• AI credentials and configuration: Authentication files for AI development tools, saved provider credentials, and LiteLLM model settings.
• Developer secrets and private keys: Git, GitHub, npm, PyPI, and CI/CD credentials; .env files; and SSH, GPG, and TLS keys.
• Browser data: Saved logins, cookies, autofill and payment data, and browsing history databases.
• Host and runtime data: Environment variables, shell and application history, and system and network information.

The stolen data was encrypted using an AES-256-CBC key, with that key encrypted using an RSA-4096 key, before being uploaded to 'litellm'.[.]Development/Health Check.

The malicious sitecustomize.py file also launched an isolated loader that checked pointers hosted on GitHub every hour, downloaded Python from an external server, and executed it on the host.

How to recover from the LiteLLM supply chain attack

Although the malicious package has been removed, potentially affected users should stop all affected deployments and inspect their environments without starting the Python interpreter.

Infected systems should be isolated and rebuilt from clean backups. All exposed credentials, keys, tokens, and other sensitive information should be rotated immediately.

Simply removing the LiteLLM package directory may not be enough because startup files and active loaders could remain on the system.

The project currently recommends LiteLLM 1.106.2, the latest clean release before the attack, as the recovery version.

LiteLLM was previously targeted in a supply chain attack

The project was previously compromised in March, when the TeamPCP hacking group published a malicious LiteLLM version on PyPI after compromising Aqua Security’s Trivy vulnerability scanner, which was used in LiteLLM’s CI/CD pipeline.

The overall prevention score can hide what happens after the initial access. If an attacker uses valid credentials, your defenses drop sharply.

The Blue Report 2026 measures defense techniques by technology across 338 million simulations run in customer production environments.

Get the report