LiteLLM 1.107.0 Compromised: Automatic Credential Theft via Python Initialization
In short: A malicious version of the LiteLLM package (1.107.0) was distributed via PyPI, executing code automatically whenever Python started in an affected environment. The payload targeted credentials across developer tools, cloud providers, and AI configurations without requiring the LiteLLM package to be explicitly imported by the application.
This summary was generated automatically by AI from Microsoft Security's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1The compromised package injected malicious files (cook.pth, cook.py, sitecustomize.py) into the Python library path.
- 2The payload executed immediately upon Python interpreter startup.
- 3Collected credentials (cloud keys, browser data, SSH, Git) were encrypted using AES-256-CBC and RSA-4096.
- 4A secondary Unix-specific loader was included to facilitate remote code execution.
Why it matters
This incident demonstrates that vulnerabilities can execute even when the malicious library isn't directly used in code. Any system, CI/CD agent, or workstation where version 1.107.0 was installed is potentially compromised. Because the payload persisted outside the package directory, standard removal of the package is insufficient; the entire environment must be audited.
What it means for AI agents and contact centers
Check all CI/CD pipelines, container base images, and developer workstations for the installation of LiteLLM 1.107.0. Do not use standard Python/pip commands to inspect these environments as they will trigger the malicious code. Rotate all API keys, database credentials, and service tokens previously accessible to any environment that ran this package version. Future supply chain security must include verification of package integrity and environment isolation.
Sources
- Microsoft SecurityOfficialPrimary sourceOriginal article →„Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks“23 Oct 2026, 21:12
- Published by source
- 23 Oct 2026, 21:12
- Found by our system
- 23 Oct 2026, 22:07
- Summary generated
- 23 Oct 2026, 22:08
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy