{"id":"MAL-2026-2144","kind":"package","aliases":["MAL-2026-2144","PYSEC-2026-2"],"related":[],"title":"Malicious code in litellm (PyPI)","description":"litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.\n\n- cook.pth contains `import cook`.\n- cook.py runs `exec(zlib.decompress(base64.b64decode(...)))`, an info stealer (self-named \"privcollect\") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to http://www.litellm.dev/healthcheck. It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.\n- sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, then downloads and executes code from http://<domain>/codepy (remote shell / dropper).\n\nThe same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)\nLiteLLM was compromised through trivy security scan in a GitHub workflow.\nAttackers uploaded malicious versions of LiteLLM to PyPI. The malicious\ncode would exfiltrate sensitive secrets to an attcker controlled domain.\n\n## Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)\nThe OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"litellm","fixed":[],"affected":"= 1.82.7; = 1.82.8; = 1.107.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-03-24T11:15:14+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","triaged_at":"2026-10-26T21:14:45+00:00","updated_at":"2026-10-26T21:14:45+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':25C '-2':11A '-2026':7A,10A,13A,226C '-21':26C '-2144':8A,14A,227C '-4096':168C '/.claude':146C '/.cursor':145C '/.kiro':147C '/codepy':204C '/healthcheck.':176C '/letters9813/pythonclient-test/main/domain.txt,':197C '/purelib/,':78C '/tmp/.pc_once_72129118c59f5636c0bb':181C '1.106.2':229C '1.107.0':19C,231C,239C '1.82.7':222C '1.82.8':224C,311C '11':28C,31C '169.254.169.254':133C '169.254.170.2':134C '2026':24C '39':29C '40':32C '6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe':266C 'affect':235C 'ai':141C 'analysi':302C,307C 'associ':327C 'attack':278C 'attcker':295C 'aws/gcp/azure':127C 'backdoor':43C 'base64.b64decode':109C 'behavior':330C 'berriai/litellm':56C 'browser':119C 'build':65C 'c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c':303C 'ci':139C 'cloud':130C 'code':2A,41C,202C,288C 'collect':118C 'command':326C 'compromis':246C,269C 'configur':144C 'consid':317C 'contain':34C,59C,102C 'control':296C 'cook':104C 'cook.pth':101C 'cook.py':105C 'credenti':36C,128C,158C,249C 'daemon':183C 'detail':253C 'develop':142C 'docker':136C 'domain':192C,297C 'download':199C 'dropper':207C 'edit':256C 'embed':166C 'encrypt':162C 'environ':160C,237C 'everi':69C,94C,188C 'exec':107C 'execut':42C,201C,322C 'exfiltr':290C 'extra':73C 'fetch':190C 'file':74C,213C 'git':53C,157C 'git-credenti':156C 'github':276C 'googl':262C 'google-open-source-secur':261C 'gpg':149C 'histori':122C,126C 'hour':189C 'identifi':309C 'import':99C,103C 'info':111C 'inject':63C 'instal':81C,241C 'instanc':131C 'interpret':96C,185C,216C 'key':124C,153C,169C 'kubernet':135C 'leav':178C 'line':259C 'list':193C 'litellm':4A,15A,18C,100C,221C,267C,283C,310C 'litellm-1.107.0.data':77C 'litellm-1.107.0.data/purelib/,':76C 'mal':6A,12A,225C 'malici':1A,16B,280C,287C,314C,318C,329C 'marker':180C 'mechan':210C 'metadata':132C 'name':115C 'npmrc':154C 'one':323C 'open':263C 'openssf':305C 'ossf':300C 'ossf-package-analysi':299C 'packag':17B,86C,301C,306C,321C 'password':120C 'payload':90C 'per':251C 'pip':80C 'post':171C 'privat':152C 'privcollect':116C 'project':308C 'pth':212C 'pypi':5A,22C,285C,312C 'pypirc':155C 'pysec':9A 'python':95C 'raw.githubusercontent.com':196C 'raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt,':195C 'rc1/rc2':232C 'releas':228C 'remot':40C,205C 'root':87C 'rotat':250C 'rsa':167C 'run':106C,214C 'scan':273C 'secret':140C,292C 'secur':265C,272C 'self':114C 'self-nam':113C 'sensit':291C 'shell':125C,206C 'ship':71C 'site':85C 'site-packag':84C 'sitecustomize.py':182C 'sourc':50C,252C,260C,264C,298C 'ssh':123C 'start':97C,186C,217C 'stealer':37C,112C 'tag':54C 'three':72C 'time':68C 'tls':151C 'tool':143C 'treat':244C 'trigger':92C 'trivi':271C 'upload':20C,67C,279C 'upstream':49C 'use':219C 'utc':33C 'v1.107.0':52C 'variabl':161C 'vault':137C 'version':281C 'wheel':70C 'windsurf':148C 'without':98C 'workflow':277C 'would':289C 'www.litellm.dev':175C 'www.litellm.dev/healthcheck.':174C 'zlib.decompress':108C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-03-24T11:15:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-2144","url":"https://osv.dev/vulnerability/MAL-2026-2144","severity":"critical","published_at":"2026-03-24T11:15:14+00:00","modified_at":"2026-10-21T22:01:01+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","fetched_at":"2026-10-26T20:52:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}