LiteLLM version 1.107.0 released on PyPI contained a credential stealer and remote code execution backdoor, according to SafeDep. The malicious release has since been removed from PyPI.
The compromised package installs three files in site-packages that execute automatically when any Python process starts on a host, even if the process never imports LiteLLM itself. All seven wheels for Linux, macOS, and Windows contained the malicious files. The upstream GitHub source repository does not contain this code.
According to the analysis, the attack works through two mechanisms. A file called cook.pth imports cook.py, which acts as a credential stealer. The stealer collects SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords, and LLM provider keys from a LiteLLM proxy database. It encrypts this data and sends it to www.litellm[.]dev. A second file, sitecustomize.py, starts a background daemon that runs every hour, reading a server address from a GitHub file, executing the stealer again, and downloading and running additional code from that server.
The malicious code was injected into the release through a modified pyproject.toml file. A line reading data = "cook" was added to the maturin build section, causing a cook/ folder to be copied into the wheel. This line did not appear in any public commit in the BerriAI/LiteLLM GitHub repository. The source distribution omitted the cook/ folder entirely, making the injection visible only in the wheel.
SafeDepanalysis found that the tag v1.107.0 points to a commit with version 1.108.0 in pyproject.toml, while the actual source distribution used version 1.107.0 with edited dependency pins matching a later commit. The wheels show characteristics of BerriAI’s normal release pipeline, including the same maturin version and correct RECORD entries. Zip timestamps indicate separate native builds for each operating system. However, no public GitHub Actions runs built the release, and PyPI lacks provenance attestations for this version.
SafeDepAssesses with moderate to high confidence that BerriAI’s private release pipeline built the wheels from an attacker-modified source. The attack vector could involve a compromised maintainer or bot credential, a private branch, or a compromised reference used by the pipeline.
Other versions including 1.106.2, 1.107.0rc1, and 1.107.0rc2 are clean, as are the companion packages litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78 that 1.107.0 pinned.
Key facts
- LiteLLM 1.107.0 on PyPI contained malicious code stealing credentials and enabling remote code execution
- The malware runs automatically with any Python process on an affected system, not just those importing LiteLLM
- Stolen data includes SSH keys, AWS/Azure/GCP credentials, browser passwords, AI tool tokens, and LLM provider API keys
- The malicious files were injected via a modified pyproject.toml adding a
data = "cook"line to the maturin build section - A background daemon downloads and executes additional code from an attacker-controlled GitHub repository hourly
- Other LiteLLM versions (1.106.2, 1.107.0rc1, rc2) and companion packages are confirmed clean
- PyPI has removed the compromised release and it lacks provenance attestations