---
id: "MAL-2026-2144"
kind: "package"
aliases: ["MAL-2026-2144", "PYSEC-2026-2"]
title: "Malicious code in litellm (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "litellm", "fixed": [], "affected": "= 1.82.7; = 1.82.8; = 1.107.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-03-24T11:15:14+00:00"
first_seen_at: "2026-10-26T20:52:00+00:00"
updated_at: "2026-10-26T21:14:45+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-2144", "first_seen_at": "2026-10-26T20:52:00+00:00"}]
---

# Malicious code in litellm (PyPI)

## Affected

- pypi:litellm affected = 1.82.7; = 1.82.8; = 1.107.0 fixed ?

## Timeline

- 2026-10-26T20:52:00+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-2144

## From the sources

litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.

- cook.pth contains `import cook`.
- cook.py runs `exec(zlib.decompress(base64.b64decode(...)))`, an info stealer (self-named "privcollect") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to http://www.litellm.dev/healthcheck. It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.
- sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, then downloads and executes code from http://<domain>/codepy (remote shell / dropper).

The same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.

---
_-= Per source details. Do not edit below this line.=-_

## Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)
LiteLLM was compromised through trivy security scan in a GitHub workflow.
Attackers uploaded malicious versions of LiteLLM to PyPI. The malicious
code would exfiltrate sensitive secrets to an attcker controlled domain.

## Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)
The OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_