🚨 URGENT SUPPLY CHAIN ATTACK: LiteLLM has been hijacked AGAIN via a new malicious v1.107.0 release!
Attackers used a lookalike repository (Berri-AI/litellm) to inject malware into the build tree, publishing backdoored platform wheels to PyPI and pushing infected Docker images.
💻 What the Malware Does
The compromise uses two highly aggressive Python startup hooks (cook.pth and sitecustomize.py), meaning the payload executes automatically when the Python interpreter initializes, even if an application never explicitly imports litellm.
The cook.py Stealer: Decodes into a massive infostealer targeting cloud credentials (AWS, GCP, Azure), SSH/GPG keys, Kubernetes secrets, .env files, browser data, and AI tokens (OpenAI, Anthropic, Claude, Cursor, Copilot).
Proxy DB Target: It spawns Prisma to actively dump all upstream AI provider keys stored inside the proxy's LiteLLM_CredentialsTable.
The Persistent RCE Loader: Sets up a detached hourly daemon that polls a GitHub dead-drop repository to fetch and raw-execute remote payloads.
🚫 The Payload Masking
This is a wheel-level/build-artifact injection. The malicious files are absent from the public Git tag and the source distribution (sdist), meaning code-only reviews will completely miss the backdoor.
🛑 Critical Remediation Steps
PyPI status: PyPI has successfully yanked 1.107.0.
Docker Warning: The floating Docker tags (latest, main-latest, main-stable) on GHCR and Docker Hub are still pointing to infected images. Stop using them immediately.
Safe Rollback: Pin your environments strictly to 1.106.2 (and pin Docker images by clean digests).
Don't just run pip: Do not begin remediation by using Python-based tools like pip inside an infected environment, as this will re-trigger the startup hooks. Manually purge cook.pth, cook.py, and sitecustomize.py using raw shell commands first.
Mass Rotation: If 1.107.0 was installed on a host with outbound internet, assume exfiltration succeeded. Rotate all credentials accessible to that host immediately.
🔗 Source Details:
JFrog Analysis: research.jfrog.com/post/litellm-h…
GitHub Issue #47826: github.com/BerriAI/litell…
Flatt Security Guidance: flatt.tech/research/posts…
Attackers used a lookalike repository (Berri-AI/litellm) to inject malware into the build tree, publishing backdoored platform wheels to PyPI and pushing infected Docker images.
💻 What the Malware Does
The compromise uses two highly aggressive Python startup hooks (cook.pth and sitecustomize.py), meaning the payload executes automatically when the Python interpreter initializes, even if an application never explicitly imports litellm.
The cook.py Stealer: Decodes into a massive infostealer targeting cloud credentials (AWS, GCP, Azure), SSH/GPG keys, Kubernetes secrets, .env files, browser data, and AI tokens (OpenAI, Anthropic, Claude, Cursor, Copilot).
Proxy DB Target: It spawns Prisma to actively dump all upstream AI provider keys stored inside the proxy's LiteLLM_CredentialsTable.
The Persistent RCE Loader: Sets up a detached hourly daemon that polls a GitHub dead-drop repository to fetch and raw-execute remote payloads.
🚫 The Payload Masking
This is a wheel-level/build-artifact injection. The malicious files are absent from the public Git tag and the source distribution (sdist), meaning code-only reviews will completely miss the backdoor.
🛑 Critical Remediation Steps
PyPI status: PyPI has successfully yanked 1.107.0.
Docker Warning: The floating Docker tags (latest, main-latest, main-stable) on GHCR and Docker Hub are still pointing to infected images. Stop using them immediately.
Safe Rollback: Pin your environments strictly to 1.106.2 (and pin Docker images by clean digests).
Don't just run pip: Do not begin remediation by using Python-based tools like pip inside an infected environment, as this will re-trigger the startup hooks. Manually purge cook.pth, cook.py, and sitecustomize.py using raw shell commands first.
Mass Rotation: If 1.107.0 was installed on a host with outbound internet, assume exfiltration succeeded. Rotate all credentials accessible to that host immediately.
🔗 Source Details:
JFrog Analysis: research.jfrog.com/post/litellm-h…
GitHub Issue #47826: github.com/BerriAI/litell…
Flatt Security Guidance: flatt.tech/research/posts…
