LiteLLM compromise uses Python startup hooks to steal credentials

A malicious build of LiteLLM 1.107.0 reached PyPI and container registries on October 21, 2026, carrying a credential stealer and remote code loader. The release was subsequently quarantined on PyPI. Floating container tags, including latest and main-stable, also pointed to the malicious image, exposing deployments that had not explicitly selected the compromised version.

The attack altered packaging rather than application code, installing cook.pth, cook.py and sitecustomize.py into Python environments. Startup hooks activate the payload before applications run, including when Python or pip is launched for investigation. The collector targets cloud credentials, private keys, environment variables, developer tokens and AI tool sessions. It also queries LiteLLM’s proxy database for stored provider credentials and model configurations. A separate loader periodically retrieves and executes remote code without signature or hash verification.

The official release tag lacked the malicious packaging changes. Build provenance instead identified Berri-AI, a lookalike of the legitimate BerriAI organization; how that override was authorized remains unestablished. Affected hosts should be isolated before inspection, without launching their Python interpreter. Recommended recovery includes rebuilding clean environments, rotating accessible credentials and restoring LiteLLM 1.106.2. Removing LiteLLM alone leaves the startup payload files behind.