LITELLM 1.107.0 was published to PyPI on 21 October 2026 with seven backdoored wheels, each carrying two covert payloads that execute at Python start. The payloads reside in three added files—cook[.]pth, cook[.]py and sitecustomize[.]py—installed into site-packages by all seven wheels across macOS, Linux, and Windows builds.
The first payload, privcollect, acts as a credential stealer, collecting browser passwords, SSH and GPG keys, cloud and provider API keys stored in LiteLLM’s proxy database, and a wide range of AI tool tokens and environment data, then encrypting and exfiltrating the data to a lookalike domain litellm[.]dev via an HTTP POST. The second payload spins up an hourly daemon that queries a GitHub dead drop for code to run, effectively enabling remote code execution on compromised hosts.
In the sdist, the build configuration injects the cook directory, but the release sdist itself remained tampered, and the attacker infrastructure and domain were staged days earlier.
Evidence assembled by StepSecurity shows the compromise was widespread due to maturin-based wheel packaging, with the attacker able to target developers and LiteLLM proxy deployments. For victims, the report recommends treating any host with litellm 1.107.0 as fully compromised, terminating the remote code loader, removing the payload files, and rotating all reachable credentials, including cloud keys, SSH and GPG keys, AI tool tokens, and API keys housed in LiteLLM’s proxy database.
It also advises blocking litellm[.]dev and monitoring for requests to the dead drop domain and the /codepy endpoint, since the hourly loader can fetch and execute attacker code. In LiteLLM proxy environments, dependent API keys and master/salt keys should be rotated. Remediation steps emphasise validation of Python environments and lockfiles to prevent reintroduction of the malicious package.