Attackers published a poisoned build of LiteLLM, the Python package that routes requests to AI model providers, and the release carried a credential stealer and a remote access trojan. PyPI has quarantined version 1.107.0, which security vendors say was uploaded around 11:39 UTC on Wednesday.
Malicious LiteLLM 1.107.0 Release Hit PyPI Wheels and Docker Images
SafeDep, Socket, StepSecurity and Upwind each reported the compromise. The affected release shipped both as PyPI wheels and as Docker images. LiteLLM is downloaded about 23 million times a week, according to reporting on the incident, which makes the package a high-value target for anyone seeking cloud and AI credentials. The last known safe version is 1.106.2.
According to the vendor reports, the attackers abused the project’s release process. They used a look-alike repository with a hyphenated name, Berri-AI/litellm, and injected three malicious files into the build. Full scope was still being assessed as of Thursday, and the number of systems that installed the package has not been published.
cook.pth, cook.py and sitecustomize.py: The Three Injected Files
The first file, cook.pth, is a loader. Python processes .pth files at startup, so the loader runs a second file, cook.py, every time the interpreter starts on an infected machine. That means the malware does not need a user to import LiteLLM; any Python process on the host can trigger it.
cook.py is an information stealer that covers 16 categories of data. The third file, sitecustomize.py, is a remote access trojan that spawns a background daemon. Together the files give the operators both a one-time sweep of secrets and a persistent foothold.
What the Stealer Collects and Where It Sends the Data
The stealer goes after browser credentials stored in Chrome, Firefox, Edge and Safari. It also collects AWS credentials, GCP service account keys, Azure CLI tokens, SSH and GPG keys, and shell history. Among the targeted secrets are API keys for large language model providers, including OpenAI, Anthropic and Cohere.
AES-256-CBC Encryption and the Lookalike litellm.dev Domain
Before exfiltration, the malware encrypts the stolen data with AES-256-CBC and wraps the key with RSA-4096. It then sends the encrypted payload to a lookalike domain, www[.]litellm[.]dev, at the path /healthcheck. The domain imitates the project’s name, which can make outbound traffic look routine in logs.
Researchers listed two indicators of compromise on infected hosts: files named /tmp/.pc_once_* and /tmp/remote_code_loader.lock. Vendors have published threat-hunting guides built around those artifacts.
Timeline and Response
The malicious package was uploaded to PyPI and Docker registries at roughly 11:39 UTC on October 21. Security vendors reported the compromise the same day, and PyPI quarantined the package afterward. Vendor guidance tells affected organizations to roll back to 1.106.2, search for the indicator files and rotate every credential on hosts that ran the poisoned release.
Any system that installed or ran 1.107.0 may have leaked cloud keys, AI provider API keys and SSH keys. Because the stealer reads shell history and key material, the exposure can reach beyond the machine that ran the package to the cloud accounts and repositories those credentials unlock.
Separate From the October LiteLLM Vulnerability Disclosure
The incident is distinct from a LiteLLM vulnerability story from October 15 and 16, in which Check Point disclosed flaws in the project. That event was a vulnerability disclosure; this one is a compromise of the distributed package itself.
LiteLLM has been hit before. Reporting on the latest attack notes that an earlier compromise in March 2026 reportedly exposed more than 2,500 organizations and 434,000 CI/CD pipelines. Those figures come from the earlier event and do not describe the scale of the current one.
Impact
The affected window runs from the upload on Wednesday until PyPI’s quarantine. The vendors that analyzed the package have not published counts of victims or confirmed stolen credentials. The combination of a widely used AI gateway library, a startup-triggered loader and exfiltration to a typosquat domain puts at risk the cloud and AI credentials held by organizations that installed it. Vendors have not said how many installs occurred.
