LiteLLM supply chain compromise: What you need to know

What it is

LiteLLM 1.107.0 is a malicious release of the Python LLM proxy library (about 23 million weekly downloads). It was live on PyPI and in the official Docker images for roughly two hours on 21 October 2026. It is the second LiteLLM supply chain compromise of 2026. Datadog Security Research linked the earlier one (versions 1.82.7 and 1.82.8) to TeamPCP, and no connection between the two has been established.

How it works

Attackers used stolen GitHub CLI OAuth tokens from three engineers to launch, approve and then delete evidence of a run of the legitimate release pipeline against the fork Berri-AI/litellm. The real repository is BerriAI/litellm, so the names differ by one hyphen. The wheels and images went out through normal channels with build provenance that accurately named the malicious fork as the source. How the tokens were first stolen was not yet known.

The package drops three files into site-packages: cook.pth, cook.py and sitecustomize.py. Python runs .pth files and sitecustomize.py at every interpreter start, so any Python process in the environment executes them, even if LiteLLM is never imported.

• cook.py collects credentials and sends them, encrypted with AES-256 and RSA-4096, to www.litellm[.]dev/healthcheck.
• sitecustomize.py checks letters9813/pythonclient-test/main/domain.txt on GitHub every hour. It downloads and runs Python code from the domain listed there.

Targeted data covers cloud credentials (AWS, GCP, Azure, instance metadata, Kubernetes, Docker, Vault, Terraform), developer secrets (SSH, GPG and TLS keys, Git, npm and PyPI tokens, .env files, shell history), LLM provider keys, sessions for AI coding tools, and browser passwords and cookies. If a LiteLLM proxy has a database configured, the payload also queries the tables that hold upstream provider credentials.

Preconditions / Affected

Anything that installed litellm 1.107.0 from PyPI or the official Docker images during the roughly two-hour window, including hosts, containers and build environments. Because the payload runs at interpreter start, every Python process in the affected environment counts as exposed.

What to do

1. Manually delete cook.pth, cook.py and sitecustomize.py from site-packages. Removing the litellm package directory does not remove them, and running the environment's own python or pip triggers the malware again.
2. Remove all code and data associated with 1.107.0.
3. Pin back to the last safe version:

litellm==1.106.2

1. From a clean machine, rotate every credential in the categories above.
2. Audit logs for use of those credentials during the exposure window.

Block or search for the domain www.litellm[.]dev and the GitHub repo letters9813/pythonclient-test as indicators.

For maintainers, Datadog recommends restricting release workflows to approved repositories and branches, and treating developer CLI tokens as high-value secrets.

Caveats

The domain.txt file has been removed and only ever held test values, so no second-stage payload was seen in the wild. The RAT capability still existed, so exposed hosts should be treated as potentially compromised. The page does not explain how the engineers' tokens were stolen.