Malicious LiteLLM 1.107.0 on PyPI steals credentials, Wiz warns
Security firm Wiz reports that a malicious version of the LiteLLM Python package, 1.107.0, was uploaded to PyPI on October 21 and designed to steal credentials from systems where it was installed. Trojanized LiteLLM Docker images were also published, according to Wiz, and the most recent safe version is v1.106.2.
- A malicious LiteLLM 1.107.0 was uploaded to PyPI at 11:39 UTC on October 21 and quarantined as of 1:20 UTC, according to Wiz.
- Docker images on GHCR and Docker Hub, including the latest, main-latest and main-stable tags, also carried the trojanized version.
- The malware steals system, browser, developer, cloud and AI tool secrets and sends them to the attacker-controlled www.litellm.dev.
- The most recent safe version is v1.106.2.
What happened
According to Wiz, the malicious LiteLLM version 1.107.0 was uploaded to PyPI at 11:39 UTC on October 21. PyPI quarantined it as of 1:20 UTC. LiteLLM is a widely used package in AI development, and the compromise reaches beyond PyPI.
Wiz says LiteLLM Docker containers on GHCR and Docker Hub also included the trojanized version. The affected tags were v1.107.0, latest, main-latest and main-stable. The most recent safe version is v1.106.2, according to the report.
How the malware works
When the malicious package is installed, three files are extracted directly into the site-packages root: cook.pth, cook.py and sitecustomize.py. Wiz explains that these files are designed to run whenever a Python interpreter starts.
At startup, the interpreter processes cook.pth, which contains a command to import cook and so loads cook.py. That file deobfuscates itself, runs a stealer routine and writes a marker to /tmp/.pc_once_72129118c59f5636c0bb. Wiz notes that this marker step fails on Windows, because the /tmp/ path often does not exist there.
The stealer routine gathers system, browser, developer, cloud and AI tool secrets, encrypts them and sends them via a POST request to www.litellm.dev/healthcheck. Wiz says this domain is attacker controlled and impersonates LiteLLM infrastructure.
Python interpreters will also try to execute sitecustomize.py, but only on Linux and MacOS machines. The script attempts to fetch a file named domain.txt from a GitHub dead drop. If it gets a response, it tries to download a second-stage Python script from http://<domain>/codepy and run it. At the time of Wiz's analysis, domain.txt had never been populated. The repository was taken down as of 1:30 PM UTC.
Affected artifacts
Wiz published SHA256 hashes so teams can check for the bad builds. The list covers seven 1.107.0 wheel files:
- macOS builds for x86_64 and arm64
- manylinux_2_28 builds for aarch64 and x86_64
- musllinux_1_2 builds for aarch64 and x86_64
- a Windows build for win_amd64
It also lists hashes for container images: ghcr.io/berriai/litellm:v1.107.0, ghcr.io/berriai/litellm-database:v1.107.0, ghcr.io/berriai/litellm-non_root:v1.107.0 and docker.io/litellm/litellm, each for linux/amd64 and linux/arm64.
What it means for users
Anyone who installed LiteLLM 1.107.0 from PyPI, or pulled the affected container tags, should treat the environment as potentially exposed, since the stealer targets cloud, developer and AI tool secrets. Wiz points to v1.106.2 as the last safe release and lists the hashes needed to identify affected instances. Wiz customers are directed to the company's Threat Intel Center advisory, titled Supply Chain Attack Targeting LiteLLM.
Because the container tags latest, main-latest and main-stable were also affected, deployments that track floating tags rather than pinned versions may have picked up the malicious build without a deliberate upgrade.
Wiz: LiteLLM Compromised, Steals Credentials
