{"id":"CMP-202610-litellm-1-107-0-on-pypi-and-docker-shipped-a-credential-stea","kind":"campaign","aliases":[],"related":[],"title":"litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader","description":null,"summary":"On 2026-10-21 an attacker used stolen BerriAI GitHub tokens (an org owner's GitHub CLI token obtained 2026-10-10 via a leaked, never-revoked LiteLLM Agent Platform master key) to hijack the release workflow and build litellm 1.107.0 from a lookalike repo Berri-AI/litellm. All seven PyPI wheels and the v1.107.0 Docker images (ghcr.io/berriai/litellm, litellm-database, litellm-non_root, docker.io/litellm/litellm; plus latest, main-latest, main-stable between 11:46 and 14:20 UTC on Oct 21) carry cook.pth, cook.py and sitecustomize.py. These run on every Python start: a stealer (privcollect) takes browser passwords, SSH/GPG keys, cloud credentials, process environments, AI coding tool configs and provider API keys from the LiteLLM proxy DB and posts them to www.litellm.dev; a daemon pulls and runs attacker Python hourly from a GitHub dead drop. About 49,000 PyPI downloads before removal. Anyone using LiteLLM SDK or proxy with an open litellm>= pin, or tracking latest image tags, is at risk. PyPI removed the release; clean releases resumed 2026-10-24.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-26T21:02:31+00:00","products":[{"name":"litellm","fixed":[],"affected":"= 1.107.0","ecosystem":"pypi"},{"name":"ghcr.io/berriai/litellm","fixed":[],"affected":"v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC","ecosystem":"docker"},{"name":"docker.io/litellm/litellm","fixed":[],"affected":"v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC","ecosystem":"docker"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Run pip show litellm and check lockfiles for litellm==1.107.0 (wheels).\n- Look for cook.pth, cook.py or sitecustomize.py in site-packages (in images: /app/.venv/lib/python3.13/site-packages/).\n- Look for a detached Python process holding /tmp/remote_code_loader.lock.\n- Check DNS/proxy logs for www.litellm.dev / litellm.dev.\n- Check whether any LiteLLM container was pulled on 2026-10-21 (v1.107.0, or latest/main-latest/main-stable between 11:46 and 14:20 UTC).","fix":"- Treat any host that installed the 1.107.0 wheel or ran an affected image as fully compromised.\n- Kill the loader process, delete cook.pth, cook.py and sitecustomize.py, and pin a clean release such as litellm==1.106.4 (or a clean image by digest).\n- Rotate every credential the host could reach: cloud keys and instance roles, SSH/GPG keys, browser passwords, AI tool tokens, CI and Vault secrets, and every provider API key stored in the LiteLLM proxy database.\n- Block litellm.dev.\n- Pin LiteLLM images by digest rather than latest/main-stable tags.","status":"open","published_at":"2026-10-21T00:00:00+00:00","first_seen_at":"2026-10-26T21:02:31+00:00","triaged_at":"2026-10-26T21:02:31+00:00","updated_at":"2026-10-26T21:02:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-0':20A '-1':18A '-10':46B,64B,65B,222B '-107':19A '-202610':16A '-21':47B '-24':223B '/berriai/litellm':36A '/berriai/litellm,':105B '/litellm':93B '/litellm/litellm':39A '/litellm/litellm;':115B '000':190B '1.107.0':2A,31A,85B '11':125B '14':128B '20':129B '2026':45B,63B,221B '21':133B '46':126B '49':189B 'a':27A 'agent':73B 'ai':92B,157B 'and':24A 'anyon':195B 'api':163B 'attack':49B,180B 'berri':91B 'berri-ai':90B 'berriai':52B 'browser':149B 'build':83B 'campaign':40B 'carri':134B 'clean':218B 'cli':60B 'cloud':153B 'cmp':15A 'code':13A,158B 'compromise':32A 'config':160B 'cook.pth':135B 'cook.py':136B 'credenti':9A,154B 'credential':28A 'daemon':176B 'databas':108B 'db':169B 'dead':186B 'docker':6A,25A,101B 'docker.io':38A,114B 'docker.io/litellm/litellm':37A 'docker.io/litellm/litellm;':113B 'download':192B 'drop':187B 'earli':42B 'early-warn':41B 'environ':156B 'everi':142B 'ghcr.io':35A,104B 'ghcr.io/berriai/litellm':34A 'ghcr.io/berriai/litellm,':103B 'github':53B,59B,185B 'hijack':78B 'hour':182B 'imag':102B,209B 'key':76B,152B,164B 'latest':117B,120B,208B 'leak':68B 'litellm':1A,17A,30A,33A,72B,84B,107B,110B,167B,197B,204B 'litellm-databas':106B 'litellm-non':109B 'loader':14A 'lookalik':88B 'main':119B,122B 'main-latest':118B 'main-stabl':121B 'master':75B 'never':70B 'never-revok':69B 'non':111B 'obtain':62B 'oct':132B 'on':22A 'on-pypi-and-docker-shipped-a-credential-stea':21A 'open':203B 'org':56B 'owner':57B 'password':150B 'pin':205B 'platform':74B 'plus':116B 'post':171B 'privcollect':147B 'process':155B 'provid':162B 'proxi':168B,200B 'pull':177B 'pypi':4A,23A,96B,191B,214B 'python':143B,181B 'releas':80B,217B,219B 'remot':12A 'remov':194B,215B 'repo':89B 'resum':220B 'revok':71B 'risk':213B 'root':112B 'run':140B,179B 'sdk':198B 'seven':95B 'ship':7A 'shipped':26A 'sitecustomize.py':138B 'ssh/gpg':151B 'stabl':123B 'start':144B 'stea':29A 'stealer':10A,146B 'stolen':51B 'tag':210B 'take':148B 'token':54B,61B 'tool':159B 'track':207B 'use':50B,196B 'utc':130B 'v1.107.0':100B 'via':66B 'warn':43B 'wheel':97B 'workflow':81B 'www.litellm.dev':174B","nicknames":["litellm 1.107.0 compromise"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-litellm-1-107-0-on-pypi-and-docker-shipped-a-credential-stea","url":null,"severity":null,"published_at":"2026-10-21T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-26T21:02:31+00:00","fetched_at":"2026-10-26T21:02:31+00:00","note":null}],"documents":[{"id":4339,"url":"https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer","title":"StepSecurity: litellm 1.107.0 Compromised on PyPI and Docker: Credential Stealer and Hourly Remote Code Loader","kind":"blog","source":"blog","text":"litellm 1.107.0 Compromised on PyPI and Docker: Credential Stealer and Hourly Remote Code Loader\n\nlitellm 1.107.0 PyPI wheels and Docker images shipped a .pth credential stealer and an hourly remote code loader that exfiltrate to litellm.dev. Analysis, IOCs, and how to respond.","published_at":"2026-10-26T14:49:48+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}