LiteLLM release pipeline hacked to distribute info-stealer malware

On October 21, 2026, attackers compromised the LiteLLM project's release pipeline and published malicious PyPI wheels and Docker images for LiteLLM version 1.107.0. The attack inserted three malicious files (cook.pth, cook.py, and sitecustomize.py) into the Python library directory, causing the malware to execute on every Python startup. The payload steals a wide range of sensitive data including cloud credentials (AWS, Azure, Google Cloud, Kubernetes, Docker), AI development credentials, developer secrets (Git, GitHub, npm, PyPI, CI/CD), browser data, environment variables, and system information. Stolen data is encrypted with AES-256-CBC and RSA-4096 keys and exfiltrated to a remote server. One malicious file also periodically downloads and executes additional Python code from an external server. The malicious artifacts were live for a short window on PyPI, Docker Hub, and GitHub Container Registry before removal. The incident follows a prior breach in March 2026 involving malicious LiteLLM versions pushed via a compromised CI/CD pipeline. The project recommends reverting to version 1.106.2 and performing thorough environment inspections and secret rotations.

The attack compromises the confidentiality of sensitive credentials and secrets across cloud platforms, AI tools, developer environments, and browsers on affected systems. The malware’s persistence mechanism ensures execution on every Python startup, increasing exposure risk. Exfiltrated data includes high-value secrets that could enable further attacks or unauthorized access. The supply-chain nature of the compromise means users who installed or updated to version 1.107.0 during the attack window were exposed. The incident affects Windows, Linux, and macOS environments. The compromise could lead to significant operational and security impacts for organizations relying on LiteLLM 1.107.0.

The malicious LiteLLM packages and Docker images have been removed from public repositories. Users should immediately stop any deployments running LiteLLM version 1.107.0. Infected systems must be isolated and rebuilt from clean backups to ensure removal of persistent malware components. Simply uninstalling the package is insufficient as malicious startup files may remain active. All secrets and credentials potentially exposed by the malware should be rotated promptly. Users should downgrade or upgrade to the clean LiteLLM version 1.106.2 or later verified safe releases. Avoid launching the Python interpreter in potentially compromised environments until remediation is complete.