October 21, 2026
Compromised LiteLLM 1.107.0 on PyPI Installed a Credential Stealer and Backdoor
The LiteLLM 1.107.0 release published to PyPI on October 21 was compromised, according to a security report from SafeDep. Every wheel — Linux, macOS, and Windows — carried a credential stealer and a remote-code backdoor into site-packages. The malicious code was not present in the project's GitHub source, and the tainted release has since been pulled from PyPI.
The stealer hid in a file called cook.pth, which made it run every time any Python process started on the machine — even ones that never used LiteLLM. It gathered SSH keys, cloud credentials, CI/CD secrets, browser passwords, and LLM provider API keys, encrypted the haul, and sent it to an attacker-run server. A second planted file started a background daemon that re-ran the stealer hourly and could download and execute new code from a server the attacker controlled.
The attacker's accounts were removed within hours, and versions 1.106.2 and the 1.107.0 release candidates were clean. Anyone who installed 1.107.0 should treat every credential on that machine as exposed: rotate keys and tokens, check for the planted files (cook.pth, cook.py, sitecustomize.py), and review systems for follow-on access.