---
id: "CMP-202610-litellm-1-107-0-on-pypi-and-docker-shipped-a-credential-stea"
kind: "campaign"
aliases: []
title: "litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader"
severity: "critical"
cvss: null
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "litellm", "fixed": [], "affected": "= 1.107.0", "ecosystem": "pypi"}, {"name": "ghcr.io/berriai/litellm", "fixed": [], "affected": "v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC", "ecosystem": "docker"}, {"name": "docker.io/litellm/litellm", "fixed": [], "affected": "v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC", "ecosystem": "docker"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: "2026-10-21T00:00:00+00:00"
first_seen_at: "2026-10-26T21:02:31+00:00"
updated_at: "2026-10-26T21:02:31+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-26T21:02:31+00:00"}]
---

# litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loader

On 2026-10-21 an attacker used stolen BerriAI GitHub tokens (an org owner's GitHub CLI token obtained 2026-10-10 via a leaked, never-revoked LiteLLM Agent Platform master key) to hijack the release workflow and build litellm 1.107.0 from a lookalike repo Berri-AI/litellm. All seven PyPI wheels and the v1.107.0 Docker images (ghcr.io/berriai/litellm, litellm-database, litellm-non_root, docker.io/litellm/litellm; plus latest, main-latest, main-stable between 11:46 and 14:20 UTC on Oct 21) carry cook.pth, cook.py and sitecustomize.py. These run on every Python start: a stealer (privcollect) takes browser passwords, SSH/GPG keys, cloud credentials, process environments, AI coding tool configs and provider API keys from the LiteLLM proxy DB and posts them to www.litellm.dev; a daemon pulls and runs attacker Python hourly from a GitHub dead drop. About 49,000 PyPI downloads before removal. Anyone using LiteLLM SDK or proxy with an open litellm>= pin, or tracking latest image tags, is at risk. PyPI removed the release; clean releases resumed 2026-10-24.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:litellm affected = 1.107.0 fixed ?
- docker:ghcr.io/berriai/litellm affected v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC fixed ?
- docker:docker.io/litellm/litellm affected v1.107.0; latest, main-latest, main-stable pulled 2026-10-21 11:46-14:20 UTC fixed ?

## How to check

- Run pip show litellm and check lockfiles for litellm==1.107.0 (wheels).
- Look for cook.pth, cook.py or sitecustomize.py in site-packages (in images: /app/.venv/lib/python3.13/site-packages/).
- Look for a detached Python process holding /tmp/remote_code_loader.lock.
- Check DNS/proxy logs for www.litellm.dev / litellm.dev.
- Check whether any LiteLLM container was pulled on 2026-10-21 (v1.107.0, or latest/main-latest/main-stable between 11:46 and 14:20 UTC).

## Fix

- Treat any host that installed the 1.107.0 wheel or ran an affected image as fully compromised.
- Kill the loader process, delete cook.pth, cook.py and sitecustomize.py, and pin a clean release such as litellm==1.106.4 (or a clean image by digest).
- Rotate every credential the host could reach: cloud keys and instance roles, SSH/GPG keys, browser passwords, AI tool tokens, CI and Vault secrets, and every provider API key stored in the LiteLLM proxy database.
- Block litellm.dev.
- Pin LiteLLM images by digest rather than latest/main-stable tags.

## Timeline

- 2026-10-26T21:02:31+00:00 analyst

## Documents

- [describes] StepSecurity: litellm 1.107.0 Compromised on PyPI and Docker: Credential Stealer and Hourly Remote Code Loader https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_