Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks

A compromised LiteLLM 1.107.0 release, published on October 21, 2026, contained malicious files that execute during Python interpreter initialization. This compromise allowed an application to launch a credential collector that targeted sensitive information across developer tools, cloud environments, browsers, and infrastructure. The payload utilized Python startup mechanisms—specifically files like cook.pth and sitecustomize.py—to achieve persistence and execution without requiring the main LiteLLM gateway functions to be actively used.
The malicious code performed multiple data collection activities, gathering credentials, configuration records from the LiteLLM proxy, and system information. Data was encrypted using AES-256-CBC and RSA wrapping before being exfiltrated to an attacker-controlled endpoint via HTTP POST. Furthermore, a separate mechanism existed for Unix-based systems that allowed for remote retrieval and execution of arbitrary Python code by checking mutable files on GitHub.
Organizations must recognize that the exposure extends beyond active LiteLLM deployments, affecting any system where Python executes with the affected package present, including developer workstations, CI/CD agents, and containers. Recovery requires remediation across all affected environments, rotation of credentials, and strengthening supply chain controls, as simply removing the package is insufficient.

* A compromised LiteLLM 1.107.0 release was published to PyPI on October 21, 2026.
* The malicious package added files that Python could execute during interpreter initialization.
* Execution paths included a credential collector launched via path extension and a Unix-oriented loader via site-specific configuration.
* The collector targeted authentication material across developer tools, AI applications, cloud environments, browsers, and infrastructure.
* A separate database module attempted to read selected credential and model-configuration records from the LiteLLM proxy.
* Malicious code executed by leveraging Python startup mechanisms, even without importing LiteLLM.
* The payload collected credentials, executed code, encrypted data using AES-256-CBC and RSA wrapping, and exfiltrated it to an endpoint.
* On Unix systems, a loader in sitecustomize.py could retrieve and execute additional Python code from a remote host via mutable domain files.
* Specific malicious file hashes for components like cook.pth and sitecustomize.py are identified.
* Indicators of compromise include communications to www[.]litellm[.]dev and hxxp://www[.]litellm[.]dev/healthcheck.

The mechanism described represents a supply chain attack that leverages trust embedded within the software distribution layer, specifically exploiting the established operational environment of Python startup routines to achieve stealthy persistence. The core vulnerability lies in allowing executable code to be injected into standard initialization pathways, effectively bypassing traditional application-layer security controls by operating at the interpreter level. This suggests that defenses focused solely on runtime monitoring or gateway security are insufficient against dependency compromise.
The pattern of credential collection targeting a vast array of sources—from cloud metadata and SSH keys to browser history—demonstrates an architecture designed for broad reconnaissance rather than a single targeted objective. The dual execution pathways, one for local persistence and another for remote code execution, indicate an attacker prioritized redundancy and adaptability, allowing the payload to remain functional even if one vector is blocked or time-sensitive.
The fact that simply starting Python in an affected environment was sufficient to trigger the attack shifts the focus from patching a specific application vulnerability to hardening the entire operating system environment where interpreted languages run. The requirement to correlate file hashes with process ancestry and network telemetry emphasizes that artifact presence alone is insufficient; understanding the sequence of events, the identity involved, and the communication flow is necessary to establish a true picture of compromise.
Bridge Questions: How can security systems be engineered to detect anomalous behavior during the initialization phase of runtime interpreters, regardless of whether a specific application module has been explicitly loaded? What organizational controls are necessary to ensure that system-level processes, like Python startup hooks, cannot grant access to sensitive credentials across disparate services? What models of accountability should shift from verifying package presence to verifying the integrity of the entire execution lineage?