Attacker pushed a LiteLLM release that steals cloud and AI credentials

Oct 22, 6:00 a.m. ET

Affected: litellm 1.107.0 from PyPI, and LiteLLM images tagged v1.107.0, latest, main-latest or main-stable and pulled on Oct 21 before LiteLLM removed them. All versions and fixes

An attacker hijacked LiteLLM’s release workflow on Oct 21 and published 1.107.0 to PyPI and Docker Hub with malware that steals credentials and can load more code, the company says. The package was on PyPI from 7:39 to 9:23 a.m. ET, and Docker Hub images pointed to it until 10:20 a.m. ET. LiteLLM says any system that ran it should be treated as compromised. Wiz saw stolen cloud credentials tested from two IP addresses the same day.

LiteLLM says the attacker held three developers’ tokens for GitHub CLI, GitHub’s command-line tool. With the token of one, an owner of LiteLLM’s GitHub organization, the attacker overrode branch protections and pointed the release workflow at a lookalike repository, Berri-AI/litellm. A second developer’s credentials approved the production release, and a third’s deleted the workflow records, which limited the logs.

LiteLLM believes the attacker took the tokens from the logs of an internal LiteLLM deployment exposed to the internet, where it found an unexpected, innocuously named user account. It says it has seen Claude Code put a user’s GitHub CLI token into a response body in specific situations, so logged responses can hold such tokens. It suspects “a recently patched vulnerability” let the attacker in, but hasn’t confirmed it.

Wiz says the release drops cook.pth, cook.py and sitecustomize.py, which run whenever Python starts. A stealer named privcollect in its code gathers browser, cloud, SSH and AI service secrets, including provider keys from the LiteLLM proxy’s database. It sends them encrypted to a lookalike domain. On Linux and macOS, a loader checks a GitHub dead drop for a second stage, which Wiz never saw delivered.

From 12:20 to 1:01 p.m. ET, Wiz saw the attacker check stolen Amazon Web Services (AWS) instance role credentials from compromised build runners and Kubernetes nodes. The attacker then listed the AI models the accounts could use. In a few environments, the attacker also listed roles, users and access keys. LiteLLM says enterprise customers using its private registry weren’t affected.

Vendor: LiteLLM

What to do

8 steps

1Run pip show litellm in every Python environment, and treat any with 1.107.0 as compromised.
2Treat any container that ran the compromised image index in the indicators as compromised, since the v1.107.0, latest, main-latest and main-stable tags served it on Oct 21.
3Search file systems for litellm-1.107.0.dist-info, cook.pth and sitecustomize.py, remembering that finding none doesn’t prove a system is clean.
4From the shell, before running any Python, delete cook.pth, cook.py, sitecustomize.py and their __pycache__ files from every affected site-packages.
5Kill the detached Python process holding /tmp/remote_code_loader.lock, then rebuild images and environments from scratch, or reinstall pinned to 1.106.2.
6On any affected host with outbound internet access, rotate the instance role, the provider keys in the LiteLLM proxy’s database, master and virtual keys, the DATABASE_URL password and environment secrets.
7Check CloudTrail for GetCallerIdentity calls by the instance role around install time, then for use of its credentials from outside the organization’s infrastructure.
8Search network logs for connections to and for activity from and , which Wiz saw testing stolen credentials.

Affected and fixed versions

Product	Affected	Fixed
litellm on PyPI	`1.107.0`, available Oct 21 from 7:39 to 9:23 a.m. ET	Pin `1.106.2`, the last safe release
LiteLLM images on Docker Hub	`v1.107.0`, `latest`, `main-latest` and `main-stable`, from 7:46 to 10:20 a.m. ET on Oct 21	Rebuild from the clean images the tags now point to
LiteLLM images on GitHub Container Registry: litellm, litellm-database and litellm-non_root	The same tags, from 7:46 a.m. ET on Oct 21 until LiteLLM found them unavailable at 9:51 a.m. ET	Rebuild from a clean image
LiteLLM enterprise release from the private registry	Not affected	No action needed

Product
litellm on PyPI
Affected
1.107.0, available Oct 21 from 7:39 to 9:23 a.m. ET
Fixed
Pin 1.106.2, the last safe release
Product
LiteLLM images on Docker Hub
Affected
v1.107.0, latest, main-latest and main-stable, from 7:46 to 10:20 a.m. ET on Oct 21
Fixed
Rebuild from the clean images the tags now point to
Product
LiteLLM images on GitHub Container Registry: litellm, litellm-database and litellm-non_root
Affected
The same tags, from 7:46 a.m. ET on Oct 21 until LiteLLM found them unavailable at 9:51 a.m. ET
Fixed
Rebuild from a clean image
Product
LiteLLM enterprise release from the private registry
Affected
Not affected
Fixed
No action needed

Indicators

Domains and IPs copy defanged. Use Copy raw for queries.

Type	Value	Note
Domain		Lookalike domain that receives stolen data, per Wiz
IP address		Tested stolen AWS credentials on Oct 21, per Wiz
IP address		Tested stolen AWS credentials on Oct 21, per Wiz
SHA-256		Compromised image index behind the Docker Hub tags, per LiteLLM
File name		Marker the stealer writes after it runs, per Wiz
SHA-256		cook.pth for Linux and macOS
SHA-256		cook.pth for Windows
SHA-256		cook.py credential stealer for Linux and macOS
SHA-256		cook.py credential stealer for Windows
SHA-256		sitecustomize.py loader for Linux and macOS
SHA-256		sitecustomize.py loader for Windows

DomainLookalike domain that receives stolen data, per Wiz
IP addressTested stolen AWS credentials on Oct 21, per Wiz
IP addressTested stolen AWS credentials on Oct 21, per Wiz
SHA-256Compromised image index behind the Docker Hub tags, per LiteLLM
File nameMarker the stealer writes after it runs, per Wiz
SHA-256cook.pth for Linux and macOS
SHA-256cook.pth for Windows
SHA-256cook.py credential stealer for Linux and macOS
SHA-256cook.py credential stealer for Windows
SHA-256sitecustomize.py loader for Linux and macOS
SHA-256sitecustomize.py loader for Windows

Timeline

Oct 21At 6:08 a.m. ET, a privileged developer’s credential overrides the protections on LiteLLM’s private release workflow.
Oct 21Seven malicious 1.107.0 packages reach PyPI at 7:39 a.m. ET.
Oct 21The release’s Docker images go out at 7:46 a.m. ET.
Oct 21PyPI has removed 1.107.0 by 9:23 a.m. ET.
Oct 21LiteLLM removes or repoints every affected Docker Hub tag by 10:20 a.m. ET.
Oct 21Wiz sees stolen AWS credentials tested from two IP addresses from 12:20 to 1:01 p.m. ET.

Sources

LiteLLM noticePrimary source docs.litellm.ai
Wiz researchPrimary source wiz.io