{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/litellm-1.107.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LiteLLM (1.107.0)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","python","credential-theft","malware"],"_cs_type":"advisory","_cs_vendors":["LiteLLM"],"content_html":"\u003cp\u003eLiteLLM version 1.107.0 was identified as malicious, having been distributed via PyPI and Docker images containing unauthorized code. The compromise occurred through the theft of GitHub CLI OAuth tokens belonging to three project engineers, which allowed the threat actor to trigger and approve a malicious release. All affected tokens have been revoked, and the organization is currently migrating to a more secure account management structure.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThreat actor obtains GitHub CLI OAuth tokens belonging to three project engineers.\u003c/li\u003e\n\u003cli\u003eThreat actor uses one compromised account to trigger a project-releaser run.\u003c/li\u003e\n\u003cli\u003eThreat actor uses a second compromised account to approve the malicious release.\u003c/li\u003e\n\u003cli\u003eMalicious LiteLLM 1.107.0 package is published to PyPI and Docker Hub.\u003c/li\u003e\n\u003cli\u003eUser installs or updates the malicious LiteLLM package.\u003c/li\u003e\n\u003cli\u003ePython interpreter loads the malicious 'cook.pth' file upon startup.\u003c/li\u003e\n\u003cli\u003e'cook.pth' triggers the 'privcollect' payload to harvest cloud tokens, keys, and browser data.\u003c/li\u003e\n\u003cli\u003eBackground daemon checks a GitHub-hosted dead drop for further instructions and executes returned Python code.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in the unauthorized exfiltration of cloud credentials, SSH private keys, browser data, and authentication files for various AI development tools. Collected data is exfiltrated as a GZIP-compressed TAR archive via HTTP POST requests to 'litellm.dev/healthcheck'.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePin dependencies to version 1.106.2 using cryptographic digests to prevent accidental installation of compromised versions.\u003c/li\u003e\n\u003cli\u003eReview all environments where LiteLLM 1.107.0 was installed for signs of credential harvesting or persistent backdoors.\u003c/li\u003e\n\u003cli\u003eRevoke and rotate all cloud credentials, API keys, and certificates present on systems that ran version 1.107.0.\u003c/li\u003e\n\u003cli\u003eMonitor Python environments for the presence of files named 'cook.pth' or usage of the 'cook' module, which are indicative of this specific malware.\u003c/li\u003e\n\u003cli\u003eImplement supply chain security practices such as ephemeral build environments and restricted permissions for GitHub CLI tokens used in automated release pipelines.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-21T19:06:48Z","date_published":"2026-10-21T19:06:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-litellm-supply-chain/","summary":"The LiteLLM Python package version 1.107.0 was compromised via stolen GitHub CLI OAuth tokens to distribute a credential-stealing backdoor that harvests cloud and developer secrets.","title":"LiteLLM: Supply chain compromise of version 1.107.0","url":"https://feed.craftedsignal.io/briefs/2026-10-litellm-supply-chain/"}],"language":"en","title":"CraftedSignal Threat Feed - LiteLLM (1.107.0)","version":"https://jsonfeed.org/version/1.1"}