LITELLM disclosed that threat actors compromised multiple independent security controls to push a malicious version of the LiteLLM Python package, designed to harvest credentials and act as a backdoor. The attack occurred on 21 October 2026, when the release pipeline was breached to publish LiteLLM 1.107.0 to PyPI and to Docker Hub registries, including the Docker images tagged as v1.107.0, latest, main-latest, and main-stable.
Users who pulled unpinned PyPI versions between 11:39 and 13:23 UTC, or used the Docker image variants between 11:46 and 14:20 UTC, are considered affected.
The poisoned artefact embeds a credential stealer and a remote access trojan, delivered via a Python path file (cook[.]pth) that imports cook[.]py. The code deobfuscates itself and runs a stealer routine named privcollect to exfiltrate system, browser, developer, cloud, and AI tool secrets to litellm[.]dev/healthcheck via HTTP POST.
The interpreter also attempts to run sitecustomize[.]py on Linux/macOS to fetch domain[.]txt from a dead drop on GitHub; if a valid response is returned, a second-stage Python script is downloaded from domain/codepy and executed. Wiz researchers noted an hourly fetch loop for a current C2 domain and observed credential abuse, including AWS IAM and Kubernetes access keys, beginning around four and a half hours after exfiltration and using stolen tokens sourced from compromised CI runners and nodes.
LiteLLM advised removing 1.107.0, isolating affected hosts, hunting for the Python artefacts, blocking the exfiltration domain, rotating credentials, and investigating /codepy execution.