On October 21, 2026, the LiteLLM package on PyPI version 1.107.0 was found to contain a credential-stealing malware and a remote access trojan. These threats were embedded within all seven distributed wheel files, affecting Docker images and posing significant risks to developer systems, build environments, and AI services.
Immediate Actions and Initial Response
Aikido issued an immediate warning to developers who installed the compromised release, advising them to consider their credentials compromised. Although PyPI removed the affected version, existing installations remain vulnerable, and any stolen credentials are still at risk of being exploited.
Socket’s security investigation revealed that its detection system flagged the malicious wheels just seven minutes post-publication, underscoring the importance of rapid detection in preventing widespread distribution through automated updates before human intervention.
Technical Details of the Attack
The attackers employed Python startup hooks instead of relying on direct imports of LiteLLM. Wiz’s technical analysis detailed that three files, namely cook.pth, cook.py, and sitecustomize.py, were placed directly into the Python site-packages directory. This setup enables the malware to activate during any Python command execution, irrespective of direct LiteLLM usage.
The malware targets various sensitive information, including system data, browser information, developer secrets, and cloud credentials. It has affected SSH keys, AWS, Google Cloud, and Azure credentials, along with browser passwords and tokens for tools like GitHub Copilot.
Response and Mitigation Strategies
Developers are urged to isolate affected systems, secure logs, and treat all accessible secrets as potentially compromised. It’s crucial to rotate and revoke cloud keys, SSH keys, and other sensitive credentials from a secure environment. Simply replacing the LiteLLM package without addressing compromised credentials will not mitigate the risk.
Wiz identified LiteLLM version 1.106.2 as the last known safe release. Rebuilding affected environments from verified sources and fixing container deployments to trustworthy image digests are recommended practices. Reviewing cloud and source control logs for unusual access is essential following the incident.
Lessons and Future Precautions
This marks the second supply chain compromise for LiteLLM within the same year, highlighting the critical nature of package security. Previous incidents involving versions 1.82.7 and 1.82.8 had exposed cloud keys and CI/CD secrets, emphasizing the prolonged impact of even brief exposure to compromised packages.
To prevent future breaches, it is imperative to update defenses against emerging malware threats promptly and integrate threat intelligence feeds across security operations centers.
