Affected Systems

LiteLLM version 1.107.0 distributed via PyPI and official container images on October 21, 2026. Affects any Python environment where the compromised package was installed, including developer workstations, CI/CD agents, test systems, containers, and LiteLLM gateway deployments. Execution occurs during Python interpreter startup without requiring LiteLLM import.

Exploitation Status

Active supply chain compromise confirmed. Malicious version 1.107.0 was published to PyPI and distributed through official container images. Microsoft observed endpoint telemetry on Windows and macOS confirming credential collection, encryption, and exfiltration behavior. Attacker used stolen GitHub credentials to alter release workflow and redirect to lookalike repository Berri-AI/litellm.

Business Impact

Critical impact for organizations using LiteLLM. The malicious package executes automatically during Python startup via .pth and sitecustomize.py hooks, targeting developer credentials, cloud API keys, browser data, SSH keys, environment variables, and LiteLLM database credentials. LiteLLM's role as a gateway to model providers means compromised systems may expose model-provider API keys, database connection strings, workload identities, and tenant policy data. Exposure extends beyond active LiteLLM deployments to any system that started Python with version 1.107.0 installed. Removing the package alone is insufficient—full credential rotation and environment remediation required.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately isolate systems with LiteLLM 1.107.0 installed. Do not start Python or pip in suspect environments during investigation, as this triggers the payload.
  • Remove LiteLLM 1.107.0 and reinstall from a known-good version. Delete malicious files: cook.pth, cook.py, sitecustomize.py from Python site-packages directory and check /tmp/.pc_once_72129118c59f5636c0bb marker file on Unix systems.
  • Rotate all credentials accessible to affected systems: GitHub tokens, cloud provider API keys (AWS, Azure, GCP), model-provider keys, database connection strings, SSH keys, browser-stored credentials, and environment variables.
  • Hunt for indicators of compromise using Microsoft Defender detections and advanced hunting queries. Search for outbound connections to attacker-controlled endpoints, file creation events for cook.pth/cook.py/sitecustomize.py, and process telemetry showing PRIVCOLLECT_ACTIVE environment variable.
  • Review container images, CI/CD pipelines, and developer workstations for LiteLLM 1.107.0 installation. Rebuild affected containers from clean base images and re-scan build agents.