ON 21 October 2026 a compromised LiteLLM 1.107.0 release was published to PyPI and distributed via official container images. The malicious wheel added Python startup files (cook[.]pth, cook[.]py, sitecustomize[.]py) that were relocated outside the litellm application directory, enabling execution during Python’s site initialisation. An application did not need to import LiteLLM for the payload to run; simply starting Python in an affected environment could trigger the credential-collection routine.
Microsoft observed two execution paths: a credential collector launched through a path extension and a Unix-oriented loader via sitecustomize[.]py. The collector targets authentication material across developer tools, AI apps, cloud environments, browsers and infrastructure, while a separate database module attempts to read LiteLLM proxy data.
Evidence from Windows and macOS showed the collector’s discovery, encryption and outbound traffic, with one Windows example where a routine Python install of an unrelated dependency activated the collector. The post stresses that removing the package or a release tag is not sufficient recovery; organisations must address the affected Python environment, surviving processes and credentials accessible to the compromised identity.
Technical details describe how the compromised wheel packaged cook[.]pth, cook[.]py and sitecustomize[.]py, and how Python’s startup processing loaded the embedded PRIVCOLLECT program. The collector encrypts data with AES-256-CBC and wraps the key with RSA OAEP before uploading to hxxp://www.litellm[.]dev/healthcheck. Data includes credentials from developer tools, cloud credentials, browser data, SSH material, environment variables and LiteLLM proxy data.
A Unix loader via sitecustomize[.]py could retrieve and execute additional code from a GitHub-hosted domain, though second-stage retrieval was not confirmed. Defence guidance covers containment, rebuilding from verified artifacts, credential rotation, and restricting outbound access, with Microsoft Defender detections and advanced hunting queries provided. TVM-2026-0003 is noted for vulnerability posture, and multiple indicators of compromise (hashes, domains, and process patterns) are listed to aid investigations.