Skip to content

Back to the catalog

Billy Lee (@billyozno) on X
x.comthread

Billy Lee (@billyozno) on X

LiteLLM 1.107.0 on PyPI shipped malware in all 7 wheels, the package's second supply-chain attack this year. It steals SSH keys, cloud credentials, browser passwords, AI tool configs and API keys, and installs a backdoor that polls for commands hourly. The GitHub source is clean, so a hijacked build or publish step is suspected. PyPI quarantined the release, but Aikido says the Docker image litellm/litellm:1.107.0 was still live. Indicators are cook.pth, cook.py and sitecustomize.py in site-packages. The advice is to rotate reachable keys and pin 1.106.2.

TL;DR Warns that LiteLLM 1.107.0 on PyPI carries a credential-stealing backdoor and lists file indicators, remediation and the safe pin 1.106.2.
Open original ↗
Document

What it is

LiteLLM 1.107.0 on PyPI contains malware in all 7 of its wheels. It is the package's second supply-chain attack this year. The post is a social media summary by Billy Lee (@billyozno) and cites Aikido for the Docker detail.

How it works

The malware steals SSH keys, cloud logins, browser passwords, AI tool configs and API keys. It also opens a backdoor that checks for new commands every hour. The GitHub source is clean, so researchers suspect a hijacked build or publishing step. The post gives no further detail on the mechanism.

Preconditions / Affected

  • PyPI release 1.107.0 of litellm.
  • The Docker image litellm/litellm:1.107.0, which Aikido says was still live after PyPI quarantined the release.

What to do

Check the installed version. 1.107.0 is the bad one.

pip show litellm

Then look in site-packages for these files:

  • cook.pth
  • cook.py
  • sitecustomize.py

Uninstalling LiteLLM does not remove these files, so a clean pip show result after an uninstall does not prove the machine is clean. Check the directory itself.

If 1.107.0 was installed, treat the machine as compromised. Rotate every key it could reach and pin 1.106.2.

Caveats

The hijacked build or publish step is a suspicion, not a confirmed finding. The post does not say when the release went up, how many installs occurred, or where the backdoor connects. It does not say whether a clean Docker tag has replaced the image.

Organisations named here

  • cook.py
  • sitecustomize.py

Technologies named here

  • pip show litellm
  • Safe version per the page
  • Aikido
  • LiteLLM
  • PyPI
  • Python
  • Docker
  • pip
  • Aikido Security

Techniques named here

  • Credential theft
  • Backdoor that polls for new commands every hour

Threat actors named here

  • cook.pth

Related in Supply Chain