LiteLLM Supply Chain Compromise

On October 21, 2026, version 1.107.0 of the LiteLLM package was identified as malicious on PyPI and Docker registries. The package contained embedded malicious scripts (cook.pth, cook.py, and sitecustomize.py) designed to execute automatically upon Python interpreter initialization. These scripts perform credential harvesting and attempt to establish command-and-control communication.

Attack Chain

1. Compromised LiteLLM package (v1.107.0) is installed via PyPI or pulled from Docker registries.
2. Python interpreter initializes, triggering the execution of cook.pth which imports cook.py.
3. cook.py runs an obfuscated credential-stealer routine targeting browser, cloud, and AI secrets.
4. Stolen credentials are encrypted and exfiltrated to an attacker-controlled endpoint (www.litellm.dev/healthcheck).
5. On Linux and macOS systems, sitecustomize.py attempts to fetch a secondary stage payload URL from a GitHub dead drop.
6. The second-stage script, if retrieved, would be downloaded and executed on the host.

Impact

The malicious package successfully harvested system, browser, developer, cloud, and AI tool secrets from compromised environments. The exfiltration endpoint was configured to receive this sensitive data via HTTP POST requests.

Recommendation

• Immediately audit environments for the presence of LiteLLM v1.107.0 and downgrade to the known safe version (v1.106.2).
• Review network logs for egress traffic to www.litellm.dev or communication attempts with GitHub-hosted dead drops from Python processes.
• Rotate all credentials (cloud, AI, browser-stored) that may have been present in environments where the malicious package was executed.
• Scan file systems for the artifacts cook.pth, cook.py, and sitecustomize.py in Python site-packages directories.