MalwarePublished 24 Mar 2026Updated 29 Oct 2026

litellm (PyPI) · Malicious Code

Affects litellmSource GCVE Database

Malicious package : remove litellm and rotate any secrets on hosts that installed it.

Data as of 29 Oct 2026, 18:08 UTC

Classification

Malicious package

Published to PyPI · OSV MAL-2026-2144

What to do

Remove litellm from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
PyPIlitellm	Affected =1.82.7 =1.82.8 =1.107.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The litellm Python package versions 1.82.7, 1.82.8, and 1.107.0 distributed via PyPI contain malicious code injected during build or upload. This code includes a credential stealer that collects a wide range of sensitive data such as browser passwords, cloud credentials, SSH keys, and developer tool configurations, encrypts it, and exfiltrates it to an attacker-controlled server. Additionally, a backdoor is installed that fetches and executes remote code periodically, enabling remote code execution. Versions 1.106.2 and 1.107.0 release candidates are not affected. Any environment with version 1.107.0 installed should be considered compromised and credentials rotated.

Impact

The malicious litellm packages exfiltrate highly sensitive credentials and secrets including browser passwords, cloud provider credentials (AWS, GCP, Azure), SSH keys, shell history, Kubernetes and Docker secrets, AI developer tool configurations, GPG and TLS private keys, and environment variables. This leads to a full compromise of affected environments, enabling attackers to gain unauthorized access to cloud resources, developer tools, and potentially execute arbitrary code remotely. The presence of a remote code execution backdoor allows ongoing attacker control and payload delivery.

Defensive guidance

Avoid using litellm versions 1.82.7, 1.82.8, and 1.107.0. Versions 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where version 1.107.0 was installed should be treated as compromised. Credentials and secrets stored on affected systems must be rotated immediately. Remove the malicious packages and reinstall only from verified clean sources. Monitor for any signs of compromise and consider rebuilding affected environments.

Summary

Malicious code was injected into litellm versions 1.82.7, 1.82.8, and 1.107.0 PyPI packages, introducing a credential stealer and a remote code execution backdoor not present in the upstream source. The payload is triggered at every Python interpreter start via .pth files and sitecustomize.py, collecting sensitive credentials and environment data, encrypting it with an embedded RSA-4096 key, and exfiltrating it to a remote server. The backdoor periodically downloads and executes code from attacker-controlled domains. The compromise occurred during build or upload, and clean versions 1.106.2 and 1.107.0rc1/rc2 are unaffected. This attack vector leverages Python packaging mechanisms to persist and execute malicious code without explicit import of the package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 29 Oct 2026, 18:08 UTC

Technical details

References

Community reviews

Related threats