LiteLLM 1.107.0 on PyPI shipped a credential stealer and RCE backdoor

#What happened

On Oct 21, 2026, the LiteLLM 1.107.0 release on PyPI carried a credential stealer and a remote code execution backdoor. All seven wheels (Linux, macOS, Windows) installed them as three files in site-packages, and both run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them.

The stealer (cook.py, loaded via cook.pth) collects SSH keys, cloud credentials, CI/CD secrets, browser passwords, LLM provider keys (including the LiteLLM proxy database), and AI dev-tool tokens including Codex auth.json, Claude Code, Cursor, Copilot, Gemini CLI, and Windsurf. It exfiltrates the data to the attacker's server.

The backdoor (sitecustomize.py) starts a detached daemon that every hour reads a server address from an attacker GitHub file, re-runs the stealer, and downloads and executes remote code.

Attack path: the attacker held the GitHub CLI credentials of three LiteLLM developers, which LiteLLM believes were taken from the logs of an internal LiteLLM deployment exposed to the internet. With an organization owner's token the attacker bypassed branch protection and pointed the release workflow at a lookalike repository (Berri-AI/litellm), and the official pipeline built, signed, and published the malicious artifacts. No public commit contains the malicious files.

Timeline (Oct 21 UTC): malicious wheels uploaded 11:39-11:40, malicious Docker tags published 11:46, PyPI removed the release by 13:23, Docker tags removed or repointed by 14:20. Versions 1.106.2 and 1.107.0rc1/rc2 are clean. LiteLLM confirmed the compromise in its incident report with remediation steps.

#Why it matters

LiteLLM is the proxy many Codex-era coding-agent setups route through, and this attack specifically targeted agent credentials like Codex auth.json plus provider API keys. Anyone who installed litellm 1.107.0 on Oct 21 should assume host credentials were exposed, rotate keys, and check site-packages for cook.pth, cook.py, and sitecustomize.py (and the /tmp/.pc_once_* marker file). The implant also targeted broader secrets (SSH keys, cloud configs, browser passwords), so the blast radius extends beyond LiteLLM users.