LiteLLM release pipeline hacked to distribute info-stealing malware

Attackers compromised LiteLLM’s release pipeline and published a malicious version of the Python package, along with malicious Docker images. The payload steals credentials, secrets and environment variables.

The attack affected all PyPI wheel packages for LiteLLM 1.107.0 and could affect Windows, Linux and macOS systems. LiteLLM is an open-source Python SDK and AI gateway that gives applications a common API for accessing models from different providers.

The project said the pipeline was compromised on October 21 and that an attacker published version 1.107.0 to PyPI and the Docker registry. A maintainer said the version contained compiled malware that steals credentials and loads remote-code execution tools. Customers using the private enterprise offering were not affected, according to the maintainer.

Researchers said the attacker changed installation files rather than LiteLLM’s application code. Three malicious files—cook.pth, cook.py and sitecustomize.py—were placed in Python’s library directory. The payload ran when Python started, and even running Python or pip to investigate an affected installation could trigger it. One file also launched a detached loader that checked a GitHub-hosted pointer every hour.

The malicious packages have been removed. The project’s recommended recovery version is LiteLLM 1.106.2, described as the latest clean release before the attack. The maintainer also reported a separate breach in March, when the TeamPCP hacking group published malicious LiteLLM versions on PyPI after breaching Aqua Security’s Trivy scanner used in LiteLLM’s CI/CD pipeline.