LiteLLM 1.107.0 Compromised: Python Startup Hooks Steal Cloud, AI, and Proxy Credentials

A malicious LiteLLM 1.107.0 release published on October 21, 2026 was quarantined after investigators found that its Python wheels and associated container images included a credential-stealing payload and remote code loader, while LiteLLM’s core application source remained unchanged. A packaging configuration change caused files named cook.pth, cook.py, and sitecustomize.py to be installed directly into Python environments, allowing code to execute whenever Python starts, including during pip commands or incident-response inspection. The payload collected host, cloud, browser, developer-tool, container, environment, and cryptographic credentials, with specialized queries targeting LiteLLM proxy database tables that may contain provider API keys and model settings, then encrypted and sent the data to an endpoint disguised as a LiteLLM health check. A separate startup component could periodically download and execute unsigned remote code from infrastructure directed through a mutable GitHub-hosted pointer. The published build appears to have come from a malicious revision rather than the official v1.107.0 tag, and provenance referenced a lookalike repository owner. Organizations are advised to identify affected package installations and images, isolate impacted systems without launching their Python environments, rebuild from clean environments, rotate all potentially accessible credentials, investigate relevant network activity, and restore using the prior 1.106.2 release with version, hash, and image-digest pinning.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.