LiteLLM 1.107.0 PyPI Package Was Backdoored
Original: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
Why This Matters
LiteLLM is widely used in AI stacks; a supply chain hit here reaches many LLM deployments.
LiteLLM 1.107.0 on PyPI contained a credential stealer and RCE backdoor across all 7 platform wheels. PyPI removed it. Versions 1.106.2 and surrounding RCs are clean, per SafeDep's Oct 21 report.
Security firm SafeDep confirmed that LiteLLM 1.107.0, distributed via PyPI across all seven platform wheels (Linux, macOS, Windows), shipped with two malicious payloads hidden in site-packages. Neither payload appears in the upstream GitHub source, suggesting the build or release pipeline was compromised, not the repo itself.
The attack works through a .pth file (cook.pth) that Python loads automatically at startup — meaning any Python process on the affected host triggers the malware, even code that never imports litellm. Payload one (cook.py) is a credential stealer targeting SSH keys, cloud provider credentials, CI/CD secrets, AI tool tokens, LLM provider API keys, and browser-stored passwords. Payload two, embedded in sitecustomize.py, is a remote code execution backdoor.
Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are confirmed clean. The companion packages pinned by 1.107.0 — litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78 — are also unaffected. PyPI has since removed the compromised release. SafeDep published indicators of compromise for teams auditing affected systems.