LiteLLM — Supply Chain Attack Delivers Credential Stealer and Backdoor

Publication date: October 21, 2026
Category: Malware / Artificial Intelligence

Introduction

The artificial intelligence development ecosystem has been rattled by a fresh software supply chain security incident. The popular Python package LiteLLM was compromised in its 1.107.0 release, maliciously distributing a credential stealer and a backdoor. The discovery and subsequent reports were brought to light by security researchers from SafeDep, Socket, StepSecurity, and Upwind, alerting the community about direct tampering with official PyPI distribution channels and Docker container registries.

What is LiteLLM? (General Analysis)

LiteLLM is a widely adopted Python library that streamlines interaction with multiple Large Language Model (LLM) providers, enabling developers to unify API calls through a standard interface and deploy self-hosted proxies. As a core component in AI architectures handling sensitive API keys, cloud provider tokens, and model configurations, its compromise represents a critical risk vector for organizational confidentiality.

  • Estimated CVSS Vector: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (Reasoned estimate based on remote code execution in the supply chain and massive credential exfiltration).
  • Estimated CWE Classification: CWE-506 (Embedded Malicious Code) and CWE-434 (Unrestricted Upload of File with Dangerous Type).

How Does It Work? (Technical Analysis)

Forensic analysis conducted by security teams uncovers a sophisticated intrusion mechanism that leveraged compromised developer credentials to inject malicious code during the package’s build and publication phase.

  • Initial Infection Flow and Entry: Threat actors successfully utilized stolen GitHub CLI OAuth tokens belonging to three project engineers. One account was leveraged to trigger the automated project-releaser build run, while another was used to approve it. The malicious v1.107.0 release was then distributed across PyPI wheels and Docker images.

  • Persistence and Pre-import Execution: The malware executes within the Python interpreter even before the LiteLLM library is explicitly imported. This is achieved via a path configuration file named cook.pth containing a single-line instruction: import cook. This mechanism forces the interpreter to automatically load and execute the credential collector payload (privcollect) upon session initialization.

  • Data Exfiltration and Backdoor:

    • Credential Theft: The payload collects cloud tokens, developer accounts, private keys, AI tooling credential JSON files, environment variables, and browser data associated with Chromium and Firefox. It also extracts saved credentials and model configurations from LiteLLM deployments.
    • Packaging and C2: The gathered data is packaged into a GZIP-compressed TAR archive and transmitted via an HTTP POST request to litellm[.]dev/healthcheck.
    • Secondary Control Mechanism: A second payload forks a background daemon that checks a GitHub repository (github[.]com/letters9813/domain.txt) every hour, reads a domain, and executes arbitrary code retrieved via an HTTP GET request against <domain>/codepy.

Affected Systems / Environments

The incident specifically affects deployments that downloaded and installed version 1.107.0 of the LiteLLM package via PyPI or Docker containers. Specific affected release wheels and artifacts include:

  • litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl
  • litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl
  • litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl
  • litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl
  • litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl
  • litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl
  • litellm-1.107.0-cp310-abi3-win_amd64.whl
  • litellm-1.107.0.tar.gz (contains the tampered pyproject.toml file without direct executable payloads).

Mitigation and Detection

Remediation

  • Secure Version Pinning: Immediately update affected environments and explicitly pin the safe prior version 1.106.2 using digest pinning.
  • Credential Revocation: Assume full compromise of any machine or development environment where version v1.107.0 was installed. Revoke and regenerate all LLM API keys, cloud credentials, GitHub tokens, and stored secrets from a clean, verified environment.
  • Account Hardening: The LiteLLM team has revoked all compromised GitHub tokens and drastically reduced permissions and access within their GitHub organization as a temporary mitigation measure.

Detection

  • Indicators of Compromise (IoCs):
    • Presence of the cook.pth file inside Python package directories.
    • Executable files or scripts in temporary directories invoking calls to litellm[.]dev/healthcheck.
    • Outbound network connections directed toward the github[.]com/letters9813 repository.
  • Behavioral Detection Rule (Conceptual):
    yaml 
    title: Suspicious .pth File Execution (Cook.pth) Detection
logsource:
  category: file_event
  product: linux / windows
detection:
  selection:
    TargetFilename|endswith: 'cook.pth'
  condition: selection
falsepositives:
  - Unknown (highly anomalous in stable production environments).
level: critical

Security Advisory: AI package supply chain attacks represent a critical operational blind spot. The automatic execution of installation scripts via .pth files bypasses traditional static-import security controls, demanding strict dependency inspection across CI/CD pipelines.

Wrapping Up

The compromise of LiteLLM version 1.107.0 demonstrates how threat actors continue to target artificial intelligence software supply chains to harvest proprietary credentials and establish persistent backdoors. The project team’s swift response in quarantining the package and revoking access mitigates future spread, but underscores the urgent industry-wide need for stringent dependency integrity controls.

References