Overview
- Security analysts found that a malicious LiteLLM wheel, published to PyPI on Wednesday, October 21, 2026, included files that run automatically at Python startup and the trojanized release and Docker images were removed from public registries within hours.
- Installing litellm==1.107.0 placed cook.pth, cook.py and sitecustomize.py into site-packages so every Python process could run a credential stealer that exfiltrated data to an attacker-controlled endpoint and a daemon that checked a GitHub dead-drop for second-stage code.
- Investigators traced the implant to attacker-made commits and a modified pyproject.toml that used maturin's data = "cook" to bundle the malicious cook/ folder into built wheels, and analysts say the compromised artifacts were built by the project’s private release pipeline rather than visible public CI runs.
- LiteLLM revoked implicated GitHub tokens, reduced organization access, and registries quarantined the malicious artifacts; responders and vendors advise users to pin to the last known good release (v1.106.2), revoke and replace exposed secrets, and remove the planted files from infected hosts.
- The compromise puts cloud instances, developer environments and AI-provider keys at risk, so teams should audit CI/CD and maintainer credentials, rotate all tokens from a clean machine, and monitor for follow-on activity as forensic investigations continue.