LiteLLM attacked again: Malicious 1.107.0 wheels on PyPI and Docker Hub (October 2026)

A malicious version of LiteLLM, version 1.107.0, was published on PyPI and distributed across official Docker images in October 2026. These artifacts contained a credential stealer and a remote code loader embedded within all seven associated wheels. The payload executes upon Python startup, regardless of direct imports, to harvest sensitive data such as SSH keys, cloud credentials, browser passwords, and LLM provider keys from the environment. The mechanism involves files like cook.pth which trigger execution at runtime, leading to the exfiltration of stolen secrets via an HTTP endpoint disguised as www.litellm[.]dev.
Chainguard customers were not affected because their security measures detected the malicious release within minutes and operate with multi-layered defenses, preventing consumption of the compromised package. Furthermore, Chainguard builds LiteLLM from verified source code in their Factory, which excludes the malicious payload, demonstrating a defense against supply chain poisoning through build verification.
If an environment has installed the affected version or pulled the specific images, immediate isolation and credential rotation are necessary. Affected users must also investigate runtime artifacts, such as startup files, lockfiles, and temporary files created by the stealer, to confirm compromise.

* LiteLLM 1.107.0 was published on PyPI on October 21, 2026.
* The malicious payload included a credential stealer and a remote code loader in all seven wheels of the package.
* Affected artifacts include litellm==1.107.0 on PyPI and specific Docker images tagged v1.107.0, latest, main-latest, and main-stable.
* The payload mechanism involves adding `data = "cook"` to `pyproject.toml` to place files like `cook.pth`, `cook.py`, and `sitecustomize.py` in the root of `site-packages`.
* Execution is triggered at Python startup via `.pth` files, causing `cook.py` to run.
* The payload collects SSH keys, GPG keys, cloud credentials (AWS, Azure, GCP), browser passwords, AI tool tokens, and LLM provider keys from the environment.
* The mechanism dumps data to a LiteLLM proxy database via `DATABASEURL`.
* Exfiltration occurs by encrypting stolen data with AES-256-CBC and sending it over plain HTTP to www.litellm[.]dev/healthcheck.
* A remote code loader is set up via `sitecustomize.py` which establishes a detached daemon that hourly downloads and executes code from a specified GitHub repository if the address resolves.
* Indicators of compromise include network traffic to www.litellm[.]dev, use of specific wheel hashes, and the presence of startup files like `cook.pth`.

The core tension in this event lies between the artifact's apparent purity (clean source code) and its execution reality (malicious wheels). The fundamental lesson is that provenance—the chain of custody from source to artifact—is insufficient protection; the executable form of a dependency must be treated as the primary security boundary. The attacker successfully decoupled the malicious artifact from the original source code by injecting payloads into prebuilt binary wheels, demonstrating that distribution channels (PyPI, Docker Hub) are as vulnerable as the source itself. This mirrors historical supply chain attacks where maintainer actions or token theft do not guarantee integrity of released artifacts.
The distinction between the official channel and the compromised artifact highlights a crucial operational gap: trust must be placed in the compiled artifact, not just the Git tag. The success of Chainguard's defense suggests that imposing external, verifiable scanning on published assets is an effective countermeasure against this type of obfuscation. However, if attackers continue to embed functionality within build processes or metadata (like `pyproject.toml` settings) rather than just injecting files, future defenses must shift upstream to validate the entire build process, not just the final package contents.
The implication for AI infrastructure is severe: compromise at a proxy layer can grant access to an organization's foundational access keys across multiple cloud providers and AI services simultaneously. The mechanism’s targeting of credential aggregation reveals a systemic risk in how dependency management interacts with secrets management in high-value environments. If the cost of securing the artifact distribution points (PyPI, Docker Hub) is lower than assuming integrity post-release, organizations are left exposed to latent vulnerabilities embedded within widely consumed libraries.
Bridge Questions: How can ecosystem tooling evolve beyond package scanning to mandate verifiable execution proofs for all deployed artifacts? What governance structures are necessary to ensure that build systems generate cryptographically verifiable guarantees about the final state of binaries, independent of metadata or repository trust? If source code remains clean, where should the primary burden of verification reside when distributing third-party dependencies?