LiteLLM 1.107.0 shipped a credential stealer and hourly remote-code loader on PyPI and in official Docker images
Any pip install or container pull of the compromised litellm 1.107.0 release on 21 October means every secret on that host and in that CI job should already be considered stolen, and the hourly loader keeps granting fresh code execution until the machine is rebuilt.
litellm 1.107.0 was published to PyPI with malware in all seven compiled wheels and the identical payload baked into the official LiteLLM Docker images, including the latest/main-stable tags; the release was built from a lookalike Berri-AI/litellm repository, with the maintainer suspecting a leaked GitHub token in AI gateway logs. A `.pth`/`sitecustomize` hook means the stealer executes on every Python process start on the host — not only when litellm is imported — harvesting SSH keys, AWS credentials, browser passwords, shell history and AI coding-tool configs, while a daemon backdoor fetches and runs attacker code hourly. PyPI has quarantined the release and the malicious Docker images were pulled.
Affected: litellm 1.107.0 (PyPI, all seven wheels); LiteLLM official Docker images built from 1.107.0, including latest and main-stable tags
How to Test
Grep lockfiles, poetry.lock/requirements/uv.lock, pip caches and CI images for litellm==1.107.0 (`pip list | grep litellm`, `pip download` cache, image SBOMs); on suspect hosts look for cook.pth or an unexpected sitecustomize.py in site-packages, a persistent Python daemon, and hourly outbound HTTP beacons from build agents or Kubernetes nodes running LiteLLM images.
How to Mitigate
Pin and reinstall litellm 1.106.2 from a clean index, delete and re-pull LiteLLM container images by digest rather than tag, rebuild or reimage any host or runner that executed 1.107.0, then rotate SSH keys, cloud access keys, provider API keys, Git tokens and browser-stored passwords from those machines.