litellm

{"schema_version":"1.7.4","id":"MAL-2026-2144","published":"2026-03-24T11:15:14Z","modified":"2026-10-29T14:16:01.288833195Z","aliases":["PYSEC-2026-2"],"summary":"Malicious code in litellm (PyPI)","details":"litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.\n\n- cook.pth contains `import cook`.\n- cook.py runs `exec(zlib.decompress(base64.b64decode(...)))`, an info stealer (self-named \"privcollect\") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to http://www.litellm.dev/healthcheck. It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.\n- sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, then downloads and executes code from http://<domain>/codepy (remote shell / dropper).\n\nThe same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d588e32a0d0ef4ceb28300723f845056e9ea26b79358479186124cd37c13d394)\nlitellm 1.107.0 is a Python LLM gateway/proxy library. No install-time or import-time code paths were observed that exfiltrate installer secrets, fetch and execute remote payloads, open a backdoor, redirect the installer's package manager, or distribute live third-party credentials. No lifecycle hooks performing network I/O, no.pth side effects beyond sys.path handling, and no credential-harvesting primitives against installer-owned paths (~/.aws, ~/.ssh, ~/.npmrc, browser or wallet stores) were found in the shipped artifact.\n\n## Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)\nLiteLLM was compromised through trivy security scan in a GitHub workflow.\nAttackers uploaded malicious versions of LiteLLM to PyPI. The malicious\ncode would exfiltrate sensitive secrets to an attcker controlled domain.\n\n## Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)\nThe OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","affected":[{"package":{"name":"litellm","ecosystem":"PyPI"},"versions":["1.82.7","1.82.8","1.107.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}]}}],"references":[{"type":"REPORT","url":"https://github.com/BerriAI/litellm/issues/24518"},{"type":"REPORT","url":"https://github.com/BerriAI/litellm/issues/24512"},{"type":"DISCUSSION","url":"https://news.ycombinator.com/item?id=47501729"},{"type":"ARTICLE","url":"https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"},{"type":"ARTICLE","url":"https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/"},{"type":"REPORT","url":"https://github.com/BerriAI/litellm/issues/47826"},{"type":"PACKAGE","url":"https://pypi.org/project/litellm/1.107.0/"}],"database_specific":{"iocs":{"domains":["litellm.cloud"],"files":[{"digests":{"sha256":"7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb"},"note":"Runs `import cook` at every Python interpreter start","paths":["litellm-1.107.0.data/purelib/cook.pth"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25"},"note":"zlib+base64 encoded credential stealer (privcollect)","paths":["litellm-1.107.0.data/purelib/cook.py"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa"},"note":"Hourly remote code loader, plus a copy of the encoded stealer","paths":["litellm-1.107.0.data/purelib/sitecustomize.py"],"source":"PACKAGE_ARCHIVE"},{"note":"Marker written by the stealer after its first run","paths":["/tmp/.pc_once_72129118c59f5636c0bb"],"source":"DROPPED"}],"urls":["https://models.litellm.cloud/"]},"malicious-packages-origins":[{"import_time":"2026-03-24T22:11:35.145201Z","modified_time":"2026-03-24T22:11:32Z","sha256":"6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe","source":"google-open-source-security","versions":["1.82.7","1.82.8"]},{"import_time":"2026-03-26T09:50:43.996758996Z","modified_time":"2026-03-24T11:15:14Z","sha256":"c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c","source":"ossf-package-analysis","versions":["1.82.8"]},{"id":"IN-MAL-2026-022275","import_time":"2026-10-29T14:14:39.386127062Z","modified_time":"2026-10-29T14:11:39Z","sha256":"d588e32a0d0ef4ceb28300723f845056e9ea26b79358479186124cd37c13d394","source":"amazon-inspector","versions":["1.107.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"},{"name":"Timothe Boulet","contact":["https://github.com/tboulet"],"type":"REPORTER"}]}