LiteLLM 1.107.0 Was Downloaded About 49,000 Times Before PyPI Pulled It
Security / explainer
LiteLLM 1.107.0 Was Downloaded About 49,000 Times Before PyPI Pulled It
The credential stealer ran whenever Python started, and the account of how attackers got in changed between Oct. 21 and Oct. 23.
A malicious LiteLLM 1.107.0 sat on PyPI for under two hours on Oct. 21 and was downloaded about 49,000 times, according to StepSecurity's count. Anyone who started Python in an environment holding it should treat that host's credentials as stolen, because the payload runs at interpreter startup and does not need LiteLLM to be imported.
LiteLLM, the open-source gateway many teams use to route requests across model providers, has said the release was built from a lookalike repository after attackers used stolen GitHub credentials. The fix is a clean version (1.106.4 or earlier) and credential rotation, not a package upgrade alone.
How the release was built: 1.107.0, dated by the minute
StepSecurity's reconstruction puts the compromise on a timeline that starts 11 days before the release. All times are UTC.
| Time | Event |
|---|---|
| Oct. 10, 21:27 | A leaked key returns a GitHub organization owner's CLI token |
| Oct. 21, 10:08 | Branch protection rejects a workflow change; an owner token overrides it five seconds later |
| Oct. 21, 11:11 | A second stolen token approves the production gate |
| Oct. 21, 11:39 | Seven 1.107.0 wheels reach PyPI |
| Oct. 21, 11:46 | Infected Docker images go out under latest, main-latest and main-stable |
| Oct. 21, 12:06 | Compromise reported in BerriAI/litellm issue #47826 |
| Oct. 21, by 13:23 | 1.107.0 removed from PyPI |
The workflow had been changed to pull from Berri-AI/litellm, a hyphenated lookalike of the real BerriAI/litellm. The Hacker News reported that LiteLLM said attackers defeated "multiple independent security controls", after maintainers had temporarily let two engineers approve releases on Oct. 19. StepSecurity credits Lidor Machluf of Upwind with the report in issue #47826.
The entry point changed between Oct. 21 and Oct. 23
The sources disagree on how the attackers got in. LiteLLM's first explanation, as The Hacker News reported it, suspected GitHub CLI tokens captured in logs of a publicly exposed internal deployment, with Claude Code embedding a user's token in a response body. StepSecurity says BerriAI's Oct. 23 attack-chain report replaced that account and that on Oct. 24 the company confirmed the Claude Code theory was not the entry point. StepSecurity's own timeline points to a master key committed to a public repository on May 27 and never revoked.
Microsoft's analysis says it has not independently confirmed how the attacker first got access. Treat the May 27 key as StepSecurity's finding, not a settled fact.
LiteLLM chief executive Krrish Dholakia was quoted by The Hacker News: "Our immediate priority is ensuring customers are protected and preventing this from happening again." Enterprise customers on LiteLLM's private registry were not affected, per the same report.
What the payload does at Python startup
The wheels install cook.pth, cook.py and sitecustomize.py into site-packages, outside the litellm folder. A .pth file is a path-configuration file that Python processes at startup, and a line in it that begins with import is executed. Microsoft says removing the package alone is not enough, and on Windows a routine pip install of an unrelated dependency triggered the collector.
The collector reads cloud credentials (AWS, Azure CLI, Google Cloud), Kubernetes service-account files, SSH and GPG keys, dotenv files, browser data and process environment variables. On LiteLLM proxy hosts it also queries database rows holding provider keys, up to 500 per query. It encrypts the haul with AES-256-CBC, wraps the key with an embedded 4096-bit RSA key, and posts it to litellm.dev/healthcheck.
A second-stage loader fetches /codepy from a server named in a GitHub-hosted file and runs the response without a signature check. Microsoft found that file empty and did not confirm the second stage, though the pointer is mutable. StepSecurity says stolen AWS instance-role credentials were used from attacker infrastructure between 16:20 and 17:01 UTC on Oct. 21.
- PyPI (11:39 to 13:23)104 min
- GHCR images (11:46 to 13:51)125 min
- Docker Hub tags (11:46 to 14:20)154 min
Source: StepSecurity timeline, accessed 2026-10-27; durations computed from its UTC times
What to do if 1.107.0 ran anywhere
Do not run pip or Python in a suspect environment to check, Microsoft says. Stop the process holding /tmp/remote_code_loader.lock first, rebuild the environment instead of repairing it, and pin litellm==1.106.4 or an image digest rather than a tag. Rotate every reachable credential from a clean machine and revoke active sessions, since key rotation may not invalidate every token.
Block litellm.dev, purge mirrors and caches of the 1.107.0 files, and review CloudTrail for unusual GetCallerIdentity calls. For related gateway and hosting coverage, see the earlier reports on Respan's Rust gateway and on Cloudflare's GLM 5.3 data exposure. BerriAI says it will skip 1.107.0 permanently and, from v1.106.3, signs images with a new cosign key, so verification against older keys now fails.
Sources
More in Security
- 01Ivanti Connect Secure Zero-Day Chain Gave Root on a Patched VPN, and the Integrity Checker Misses ItVolexity dates exploitation to October 3, ten days before Ivanti's advisory; the root escalation step has no CVE and no fix in the sources reviewed.
- 02Alpine Logged GitLab CVE-2026-97229 Attacks Nine Days Before CISA Listed ItAlpine's incident report shows the CVSS 10.0 flaw was exploited against its own server on Oct. 20 and 21, and that two GitLab 19.3 builds it ran still carried the bug.
- 03KPMG Could Not Confirm the Deepfake in Capillary's €3 Million FraudCapillary Technologies blamed deepfake cloning in July, but the forensic audit it filed on Oct. 31 calls the loss a payment-diversion scam and says the missing recordings and phone data leave deepfakes unproven.
- 04Linux TCP Flaw CVE-2026-98432 Still Unpatched on RHEL and UbuntuThe kernel team scores the use-after-free 9.8, Anthropic says its model wrote a root exploit for it, and the two biggest enterprise distributions have no fixed kernel.