Compromised LiteLLM package steals cloud and AI credentials from affected organisations
Malicious version 1.107.0 of the LiteLLM library exfiltrates secrets from browsers, cloud platforms and AI tools to an attacker-controlled domain.
Key points
- Version 1.107.0 was uploaded to PyPI and Docker on 21 October and included credential-stealing code.
- The malware targets browser data, cloud credentials and AI tool secrets, sending them to a fake domain.
- PyPI quarantined the package within two hours, but Docker images with the trojan remain accessible.
Organisations using the LiteLLM library for artificial intelligence integrations face immediate exposure of sensitive credentials. A malicious version of the software, released on 21 October, contains code designed to steal secrets from user environments. This incident affects anyone who installed the compromised package or associated container images during the brief window before detection.
What data is being stolen and how?
The trojanised version 1.107.0 extracts three files into the Python site-packages directory upon installation. These files execute automatically whenever a Python interpreter starts. The primary script, cook.py, deobfuscates itself and runs a routine that gathers system information, browser data, developer tokens, cloud credentials and AI tool secrets. This collected data is encrypted and sent via a post request to www.litellm.dev/healthcheck, a domain controlled by the attackers that impersonates legitimate LiteLLM infrastructure.
Which platforms and versions are affected?
According to Wiz, the malicious package appeared on PyPI at 11:39 UTC on 21 October. It was quarantined by the platform at 1:20 UTC. However, Docker containers on GHCR and Docker Hub also contained the compromised code. Affected Docker tags include v1.107.0, latest, main-latest and main-stable. The most recent safe version of the software is v1.106.2. Users who pulled images using the affected tags during this period likely installed the trojanised version on their systems.
Is there additional malware functionality?
Yes. On Linux and macOS systems, the package attempts to execute sitecustomize.py. This script tries to fetch a domain name from a GitHub repository used as a dead drop. If it receives a response, it downloads and runs a second-stage Python script from the specified domain. As of the time of analysis, the GitHub file was empty and the repository had been taken down. This suggests the attackers retained the ability to push further commands, though no secondary payload was confirmed to have executed.
What is the current status of the threat?
PyPI has quarantined the malicious wheel files, preventing new downloads. The GitHub repository used for command-and-control communication has been removed. However, the Docker images tagged as latest, main-latest and main-stable still exist on public registries. Organisations must verify their installations against the known safe version, v1.106.2. Wiz advises customers to review their Threat Intel Center advisory for specific supply chain attack details related to this LiteLLM compromise.
What affected people can do
Teams should immediately audit their Python environments and Docker containers for version 1.107.0 or any image tagged as latest from 21 October. Check system logs for unusual outbound connections to unknown domains, particularly those resembling legitimate service endpoints. Rotate all cloud credentials, browser passwords and AI API keys that may have been stored in the affected environment. Monitor for follow-up phishing attempts that reference this incident, as attackers often use known breaches to trick users into revealing new login details.
What to do and how to stay safe: LiteLLM
- Verify that your Python installations are running version 1.106.2 or earlier, or a subsequent patched version if available.
- Scan Docker registries and local containers for images tagged with latest, main-latest or main-stable pulled on 21 October.
- Rotate all secrets, including cloud access keys and AI provider tokens, that were accessible to the compromised LiteLLM process.
- Monitor network traffic for connections to www.litellm.dev/healthcheck or any other domains impersonating LiteLLM infrastructure.
Step-by-step guide: Spot Business Email Compromise: Hidden Signs and Immediate Response
General security guidance from the Phish Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
When was the malicious LiteLLM package uploaded?
The malicious version 1.107.0 was uploaded to PyPI at 11:39 UTC on 21 October.
What is the last known safe version of LiteLLM?
According to the source material, the most recent safe version is v1.106.2.
Did the attackers successfully execute secondary malware?
No. The GitHub dead drop used for second-stage downloads was empty and the repository was taken down.
