LiteLLM compromised again: infostealer and RAT found in version 1.107.0

A critical security vulnerability was discovered in LiteLLM, specifically version 1.107.0, involving the injection of malicious code into published Python wheels on PyPI and the official Docker image. The compromise introduces two threat vectors: an infostealer designed to exfiltrate sensitive credentials and system data upon initial execution, and a remote access trojan (RAT) enabling persistent, arbitrary remote command execution. This breach occurred because an attacker exploited a directive within LiteLLM's `pyproject.toml` used by the maturin build tool, allowing unauthorized files to be bundled into the distributed packages without altering the source code repository.
Immediate actions include advising users who installed or pulled the compromised version to check for specific sentinel and lock files in `/tmp/`. Furthermore, PyPI has quarantined this version, though the malicious Docker image remains active on Docker Hub. The stolen data scope is extensive, including browser passwords (AES-decrypted), SSH keys, cloud credentials across major providers, CI/CD secrets, and environment variables from running processes.

LiteLLM version 1.107.0 was compromised by an attacker who injected malicious code into Python wheels on PyPI.
The attack affected the official Docker image litellm/litellm:1.107.0, as well as pulls using tags like main-latest and main-stable.
The malware contains an infostealer that exfiltrates credentials upon first run and a RAT for remote code execution.
The injection exploited a `[tool.maturin] data = "cook"` directive in LiteLLM's pyproject.toml file.
Three malicious files were injected into site-packages: cook.pth, cook.py (the infostealer), and sitecustomize.py (the RAT).
The infostealer targets system info, browser credentials (Chromium/Firefox), SSH keys, cloud provider secrets, and CI/CD configuration files.
Data exfiltration is sent via HTTP POST to http://www[.]litellm[.]dev/healthcheck using an RSA-4096 public key for encryption.
The RAT daemon fetches commands hourly from https://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt
Sentinel files indicating compromise are /tmp/.pconce* and /tmp/remotecodeloader.lock.
PyPI has quarantined version 1.107.0, but the Docker image remains live on Docker Hub.

The incident exemplifies a sophisticated Supply Chain Attack targeting developer trust in open-source ecosystems. The method—manipulating the build tooling (`pyproject.toml` and maturin) to inject code without touching source control—is highly advanced, demonstrating an attacker's capability to poison software at its point of compilation and distribution, rather than during active use or repository contribution. This pattern leverages the trust inherently placed in package management metadata (like `data = "cook"`) as a vector for subverting integrity verification.
The scope of data stolen is alarmingly comprehensive, touching not only cloud API keys but also deeply personal artifacts like SSH private keys and browser decryption secrets. This suggests the operation has dual objectives: reconnaissance/credential harvesting (via infostealer) and persistent remote access/lateral movement capability (via RAT). The threat transforms a convenience utility into an undetectable sleeper agent capable of indefinitely expanding its footprint.
The immediate response, while containing the package on PyPI, is insufficient because the malicious artifact persists in the Docker Hub registry. This highlights a systemic fragility: security remediation must track vulnerabilities across diverse distribution channels (package managers vs. container registries). Furthermore, the mechanism relies on multiple chained dependencies—Python startup hooks (`.pth`, `sitecustomize.py`) and asynchronous C2 polling—suggesting an adversary highly experienced in stealthy persistence layers.
Patterns detected: ARC-013 Supply Chain Compromise, ARC-0045 Weaponized Trust