How do I check whether I am affected by CMP-202610-litellm-1-107-0-on-pypi-and-docker-shipped-a-credential-stea?

- Run pip show litellm and check lockfiles for litellm==1.107.0 (wheels). - Look for cook.pth, cook.py or sitecustomize.py in site-packages (in images: /app/.venv/lib/python3.13/site-packages/). - Look for a detached Python process holding /tmp/remote_code_loader.lock. - Check DNS/proxy logs for www.litellm.dev / litellm.dev. - Check whether any LiteLLM container was pulled on 2026-10-21 (v1.107.0, or latest/main-latest/main-stable between 11:46 and 14:20 UTC).

Live › campaign › CMP-202610-litellm-1-107-0-on-pypi-and-docker-shipped-a-credential-stea

Go to dashboard

critical⚡ Early warning · no CVE yetlitellm 1.107.0 compromiseExploited in the wildPackage

litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader

Q: What is the fix for CMP-202610-litellm-1-107-0-on-pypi-and-docker-shipped-a-credential-stea?

- Treat any host that installed the 1.107.0 wheel or ran an affected image as fully compromised. - Kill the loader process, delete cook.pth, cook.py and sitecustomize.py, and pin a clean release such as litellm==1.106.4 (or a clean image by digest). - Rotate every credential the host could reach: cloud keys and instance roles, SSH/GPG keys, browser passwords, AI tool tokens, CI and Vault secrets, and every provider API key stored in the LiteLLM proxy database. - Block litellm.dev. - Pin LiteLLM images by digest rather than latest/main-stable tags.

On 2026-10-21 an attacker used stolen BerriAI GitHub tokens (an org owner's GitHub CLI token obtained 2026-10-10 via a leaked, never-revoked LiteLLM Agent Platform master key) to hijack the release workflow and build litellm 1.107.0 from a lookalike repo Berri-AI/litellm. All seven PyPI wheels and the v1.107.0 Docker images (ghcr.io/berriai/litellm, litellm-database, litellm-non_root, docker.io/litellm/litellm; plus latest, main-latest, main-stable between 11:46 and 14:20 UTC on Oct 21) carry cook.pth, cook.py and sitecustomize.py. These run on every Python start: a stealer (privcollect) takes browser passwords, SSH/GPG keys, cloud credentials, process environments, AI coding tool configs and provider API keys from the LiteLLM proxy DB and posts them to www.litellm.dev; a daemon pulls and runs attacker Python hourly from a GitHub dead drop. About 49,000 PyPI downloads before removal. Anyone using LiteLLM SDK or proxy with an open litellm>= pin, or tracking latest image tags, is at risk. PyPI removed the release; clean releases resumed 2026-10-24.

Summary written from the sources below. Check the originals before acting.

Known so far

5/6

critical

no CVSS yet; severity from the sources

known so far5 of 6

missing: primary source

First public: Oct 21, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: Yes
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 21:02 UTC. All times on this page are UTC.

Who is affected

3 products

Product	Ecosystem	Affected	Fixed in
litellm	pypi	= 1.107.0	–
ghcr.io/berriai/litellm	docker	v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC	–
docker.io/litellm/litellm	docker	v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC	–

Who cares: campaign, early-warning
Not affected if: –

How to check

Run pip show litellm and check lockfiles for litellm==1.107.0 (wheels).
Look for cook.pth, cook.py or sitecustomize.py in site-packages (in images: /app/.venv/lib/python3.13/site-packages/).
Look for a detached Python process holding /tmp/remote_code_loader.lock.
Check DNS/proxy logs for www.litellm.dev / litellm.dev.
Check whether any LiteLLM container was pulled on 2026-10-21 (v1.107.0, or latest/main-latest/main-stable between 11:46 and 14:20 UTC).

Know the next one before it finds you.

Add to Slack

litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

litellm

pypi

= 1.107.0

–

ghcr.io/berriai/litellm

docker

v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC

–

docker.io/litellm/litellm

docker

v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC

–

litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader

Who is affected

How to check

Know the next one before it finds you.

litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader

Who is affected

How to check

Know the next one before it finds you.

The fix

Who had it, and when

Sources