Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to PyPI and distributed via official container images. The malicious package included Python startup files (cook.pth, cook.py, sitecustomize.py) that executed automatically during Python interpreter initialization, without needing the application to import LiteLLM. The payload launched a credential collector daemon targeting developer tools, AI applications, cloud credentials, browsers, SSH keys, environment variables, and LiteLLM proxy database data. Collected data was encrypted and exfiltrated to attacker-controlled endpoints. The compromise was enabled by stolen developer GitHub credentials that redirected the release workflow to a lookalike repository and bypassed production approval. The attack affected developer workstations, CI/CD agents, test systems, and containers. On Unix systems, the payload could retrieve and execute additional Python code. Microsoft advises against starting Python or pip in suspect environments to detect the compromise. Recovery requires addressing the Python environment, surviving processes, and exposed credentials. Microsoft Defender includes detection and hunting tools. No explicit patch or fixed version is provided.

The compromise allows attackers to steal a broad range of sensitive credentials and configuration data from affected environments, including developer GitHub credentials, cloud API keys, browser data, SSH keys, environment variables, and LiteLLM proxy database records. This can lead to further unauthorized access and lateral movement within development, cloud, and infrastructure environments. The automatic execution of malicious code on Python startup means even indirect use of Python in affected environments can trigger credential theft, increasing exposure risk. The attack impacts multiple platforms including Windows and macOS, and affects developer workstations, CI/CD pipelines, containers, and test systems.

No official patch or fixed version is stated. Removing the compromised LiteLLM 1.107.0 package or release tag alone is insufficient. Organizations must remediate by cleaning or rebuilding affected Python environments, terminating any surviving malicious processes, and rotating all potentially exposed credentials. Investigators should avoid starting Python or pip in suspect environments to prevent triggering the payload. Microsoft Defender detection and advanced hunting queries are available to identify and respond to the compromise. Follow vendor guidance for recovery and credential rotation.