LiteLLM compromised again: infostealer and RAT found in version 1.107.0

What it is

LiteLLM 1.107.0, an open source proxy for routing requests across LLM providers, was found compromised on 21 October 2026. Aikido reports two payloads in the published wheels: an infostealer that fires once, and a RAT that stays resident. The official Docker image litellm/litellm:1.107.0 is also compromised.

How it works

The attacker used maturin's data = "cook" directive in pyproject.toml. The cook/ directory is absent from the source tarball and GitHub. It existed only in the compromised build environment, so source review would not show it.

Three files land in site-packages:

• cook.pth is 12 bytes (import cook). It runs cook.py at every interpreter start.
• cook.py is the infostealer, one obfuscated line that unpacks a 61,000-byte payload.
• sitecustomize.py is the RAT. It forks a daemon that takes a lock at /tmp/remote_code_loader.lock.

Every hour the daemon reads the current C2 domain from a file in the GitHub repo letters9813/pythonclient-test. It then fetches Python from http://{domain}/codepy and runs it with exec, unsandboxed, with the privileges of the Python process.

The stealer sends RSA-4096-encrypted data by HTTP POST to www[.]litellm[.]dev/healthcheck. That domain is attacker-controlled. Collected data includes:

• Cloud credentials, including live metadata endpoints for AWS, GCP and Azure.
• SSH, GPG and TLS private keys.
• Kubernetes service account tokens, Docker config and Swarm secrets.
• CI/CD secrets: GitLab runner, Jenkins and Vault.
• Config for AI developer tools: Claude Code, Cursor, Copilot, Codex CLI and others.
• Browser passwords and shell history.
• Environment variables, including those of every other process on Linux via /proc/<pid>/environ.
• LiteLLM's own database tables LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable, which hold stored provider API keys.

Preconditions / Affected

• Any install of litellm==1.107.0 from a compiled wheel, on any OS. The seven wheels are cp310-abi3 builds for macOS x86_64 and arm64, manylinux_2_28 and musllinux_1_2 (each x86_64 and aarch64), and win_amd64.
• The Docker image litellm/litellm:1.107.0, and the latest, main-latest and main-stable tags that resolved to it.
• As of the post's update, PyPI has quarantined 1.107.0. The Docker image was still live on Docker Hub.

What to do

Anyone who installed or ran the affected version should assume credentials are compromised. Check for these files:

• /tmp/.pc_once_*: the exfiltration has already fired. The sentinel is /tmp/.pc_once_72129118c59f5636c0bb.
• /tmp/remote_code_loader.lock: the C2 daemon ran or is still running.

Other checks:

• Compare wheel hashes against the SHA256 values in the post. Example: 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 for manylinux_2_28_x86_64.
• Search egress logs for litellm[.]dev, and for requests to raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt.
• Search proxy logs for POSTs with the User-Agent Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0) and the header X-Token: XWiA8gZNa7NcX2XRoAEb.

Caveats

The post names no clean replacement version and gives no removal steps. Because the RAT runs arbitrary attacker code, the post implies a host with the daemon may have been altered beyond these files, but it does not say so directly. The post's title says "again", but the page text gives no details of an earlier incident.