A compromised LiteLLM release, version **1.107.0**, carried credential-stealing malware in all seven PyPI wheels and in affected Docker images. The packages were available from 11:39 to 13:23 UTC on 21 October 2026; affected image tags remained on GHCR until 13:51 UTC and on Docker Hub until 14:20 UTC. The article says the official GitHub source tag was not infected.
Attackers reportedly used stolen GitHub CLI OAuth tokens belonging to three LiteLLM engineers to alter the release workflow and publish the malicious build.
The malware installed `cook.pth`, `cook.py` and `sitecustomize.py` in Python’s `site-packages`, making it run whenever a Python interpreter started, even if LiteLLM was not imported. It collected cloud, Kubernetes, SSH, AI-tool and browser secrets, as well as LiteLLM proxy credential tables, and sent them to a lookalike domain. On Linux and macOS, an additional component checked GitHub hourly for remote code.
By 22 October, Wiz had observed attackers testing stolen AWS role credentials, then listing Amazon Bedrock models and enumerating IAM resources; the remote loader appeared dormant.
Anyone who ran version 1.107.0 or an affected image should treat the host as compromised. LiteLLM advises using **1.106.2** or another release published before 21 October, and pinning exact image digests rather than floating tags. The article warns against using `pip` to remove the package in an affected environment, as starting Python may retrigger the payload. It recommends isolating affected systems, rebuilding from trusted artefacts and rotating exposed credentials from a clean machine.