LiteLLM 1.107.0 Compromise Delivered Credential Stealer and Backdoor
LiteLLM version 1.107.0 was compromised in a software supply-chain attack that distributed a credential stealer and a backdoor through PyPI wheels and Docker images. Security firms SafeDep, Socket, StepSecurity and Upwind reported the incident. PyPI has quarantined the affected Python package, while the malicious Docker images have been removed.
LiteLLM said its investigation is continuing and that it is still tracing the initial access path used to publish the malicious release. Oliver Jensen, LiteLLM’s director of security, said the activity involved three engineers’ GitHub accounts and appeared to rely on stolen GitHub CLI OAuth tokens.
Compromised release process
The attacker used one compromised account to trigger the project-releaser workflow and another to approve it. LiteLLM revoked every token involved in the incident and temporarily removed all but one unaffected user from its GitHub organization. It also removed trusted links to the organization from public registries to prevent further malicious package publication.
The affected artifacts include platform-specific 1.107.0 wheels for macOS, Linux and Windows, as well as the litellm-1.107.0.tar.gz source archive. The archive contains no payload files, but its pyproject.toml was tampered with. Teams should treat installed copies of the affected release as potentially hostile even where the package format differs.
What the malicious code did
StepSecurity identified a credential-stealing payload named privcollect and a second component that forks a background daemon. The daemon checks a GitHub dead drop every hour, retrieves attacker-supplied Python code, and executes it.
The malware is launched before LiteLLM itself is imported. A path file named cook.pth causes Python to execute import cook when the interpreter starts, which loads the credential collector. This execution pattern was also observed during the LiteLLM compromise linked to the TeamPCP supply-chain attacks earlier in March.
Analysis found that the collector searched for cloud tokens, developer-account credentials, private keys, AI development-tool credential JSON files, Chromium and Firefox browser data, and environment variables. It could also target LiteLLM deployments to extract saved proxy credentials and model configuration. Collected information was packaged into a GZIP-compressed TAR archive and sent by HTTP POST to litellm[.]dev/healthcheck.
The code also consulted domain.txt in the GitHub repository github[.]com/letters9813. If that file supplied a domain, the malware could run the stealer and request <domain>/codepy, executing the returned content. The repository was returning a 404 error at the time described in the reports.
Immediate actions for users
Organizations that downloaded LiteLLM 1.107.0 should revoke and replace potentially exposed credentials from a clean environment, then investigate systems that installed or executed the release. LiteLLM advises users to pin version 1.106.2 by digest. For engineering teams, the incident makes release approvals, OAuth-token protection, dependency verification and credential rotation practical controls for limiting the impact of a compromised package publication.