litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader

On October 21, 2026, the Python package litellm version 1.107.0 was compromised on PyPI, with all seven compiled wheels and official Docker images containing malicious payloads. The attack originated from a lookalike GitHub repository (Berri-AI/litellm) that was used to build the release, bypassing security controls. The malicious wheels install three files—cook.pth, cook.py, and sitecustomize.py—into the Python site-packages directory, which execute automatically on every Python interpreter start. These payloads include a credential stealer named 'privcollect' that exfiltrates sensitive data such as browser passwords, SSH and GPG keys, cloud credentials, and LiteLLM proxy database contents to the domain www.litellm.dev, and a remote code loader that polls a GitHub dead drop hourly for additional commands. The attacker gained access through stolen GitHub tokens exposed in logs and modified the release workflow using an organization owner's token, allowing the malicious artifacts to be signed and published through legitimate channels.

AI-extracted · verify before operational use