AI BriefingLiteLLM 1.107.0 PyPI Compromise Installs Credential Stealer and Backdoor
·2026.10.21 09:00
Key point
The compromised release injects malware into all Python processes on the host to steal SSH keys, cloud credentials, and AI tool tokens.
Details
- LiteLLM 1.107.0 on PyPI contained a credential stealer and remote code execution backdoor in all seven wheels (Linux, macOS, Windows), which PyPI has since removed.
- The malware executes in every Python process on the host via
cook.pthandsitecustomize.py, collecting SSH keys, cloud credentials, CI/CD secrets, browser passwords, and LLM provider keys from LiteLLM proxy databases. - Stolen data is encrypted with AES-256-CBC and RSA-OAEP, then sent to
www.litellm[.]dev/healthcheckusing the tokenXWiA8gZNa7NcX2XRoAEb. - A background daemon in
sitecustomize.pyruns hourly, fetching a server address from a GitHub file and executing downloaded code, allowing the attacker to pivot to new infrastructure. - The injection occurred via a
data = "cook"line in thepyproject.tomlof the source distribution, a change not present in the upstream GitHub repository or the legitimate 1.106.2 and 1.107.0rc2 releases. - SafeDep assesses with moderate to high confidence that BerriAI’s private release pipeline built the malicious wheels from an attacker-modified git source, possibly via compromised maintainer or bot credentials.
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Alter launches YC S25 platform for privileged access management of AI agentsTrail of Bits releases patching-bugs and regression-hunt plugins for AI-driven security fixes