LiteLLM Compromised, Steals Credentials

What it is

LiteLLM 1.107.0 was uploaded to PyPI at 11:39 UTC on 21 October 2026 with a credential stealer. The same build reached container images on GHCR and Docker Hub under the tags v1.107.0, latest, main-latest and main-stable. The last safe version is v1.106.2. Wiz says PyPI quarantined the package, but its stated time (1:20 UTC) is earlier than the upload time, so the exact exposure window is unclear.

How it works

Installing the package writes three files into the site-packages root: cook.pth, cook.py and sitecustomize.py. They run whenever a Python interpreter starts, not only when LiteLLM is imported.

• cook.pth imports cook, which loads cook.py. That script deobfuscates itself and runs a stealer for system, browser, developer, cloud and AI tool secrets. It encrypts the data and POSTs it to www.litellm.dev/healthcheck, an attacker-controlled lookalike domain. It also writes a marker file at /tmp/.pc_once_72129118c59f5636c0bb. This fails on Windows, where /tmp often does not exist.
• sitecustomize.py runs on Linux and macOS only. It fetches domain.txt from a GitHub dead drop (letters9813/pythonclient-test/main/domain.txt). If that returns a domain, it downloads a second-stage script from http://<domain>/codepy and runs it. At the time of analysis domain.txt was never populated, and the repo was taken down by 1:30 PM UTC.

The payload came from the repository github.com/Berri-AI/litellm, a hyphenated lookalike of the real BerriAI organization. That repository is not visible on GitHub. Between 08:56 and 10:46 UTC on 21 October the attacker pushed 10 commits using the author email ckdi82fkoos@proton.me:

1. Three commits within 2 minutes added the three files.
2. Four commits bumped the version to 1.107.0.
3. After a 39-minute gap, two commits refined the payload and added data = "cook" to pyproject.toml, which made the build bundle the malware into the wheel.
4. A final commit 58 minutes later used a different email (Berri-AI@users.noreply.github.com) and was unsigned. It added COPY cook ./cook to the Dockerfiles, which put the payload in the images.

The first nine commits were made on GitHub.com, so they carry GitHub's verified signature. A verified badge therefore did not indicate a trustworthy author.

Preconditions / Affected

• PyPI installs of litellm 1.107.0.
• Container images pulled from GHCR or Docker Hub with the four tags above.
• The stealer runs on any OS. The second-stage fetch runs only on Linux and macOS.

What to do

• Pin to 1.106.2 or earlier, and check whether any environment or image resolved to 1.107.0 or to the floating tags (latest, main-latest, main-stable) during the window.
• Check for cook.pth, cook.py and sitecustomize.py in site-packages, and for the marker file /tmp/.pc_once_72129118c59f5636c0bb.
• Look for outbound traffic to www.litellm.dev and requests to the GitHub dead drop path.
• The page implies, but does not state, that secrets on an affected host should be treated as exposed.
• The full commit diff is at github.com/BerriAI/litellm/compare/a8113b0d...20535d8f, reachable through the parent repository because of Git fork object sharing.

Caveats

The page's recommendations section only points Wiz customers to their Threat Intel Center advisory. The indicators-of-compromise table did not come through in the fetched text. The page does not explain how the attacker gained access to the release pipeline.