LiteLLM Supply Chain Compromise: Malware Targeting Developer Data

The LiteLLM project suffered a supply chain compromise that led to the distribution of malicious versions designed to steal credentials and sensitive data from developer systems.

2026-10-22

2 min read

2 views

Global

certi.news Editorial Team

Compromise Details

The LiteLLM project, an open-source software gateway used to connect applications to AI models, was subjected to a supply chain attack on October 21, 2026. This compromise resulted in the distribution of a malicious version numbered 1.107.0 via the PyPI repository and Docker Hub and GHCR platforms, putting users of Windows, Linux, and macOS systems at risk of data theft.

Malware Mechanism

Security researchers explained that the attackers did not touch the project's core source code, but instead injected three malicious files (cook.pth, cook.py, and sitecustomize.py) into the installation packages. These files execute a payload every time a Python environment is launched, ensuring persistence even when a developer attempts to inspect the infected package.

The malware targets a wide range of sensitive data, including:

Cloud Credentials: Such as AWS, Azure, Google Cloud, and Kubernetes keys.
Developer Secrets: SSH, GPG, and TLS keys, in addition to Git, GitHub, and npm credentials.
Browser Data: Cookies, browsing history, and saved payment information.
AI Settings: AI service provider credentials stored within LiteLLM.

What Should Developers Do?

If you have installed version 1.107.0, it is essential to take immediate recovery steps:

Isolate Systems: Do not run the Python interpreter in infected environments, as this triggers the malware.
Rebuild: Affected systems must be isolated and rebuilt from clean, trusted backups.
Rotate Keys: Assume that all secrets, passwords, and access keys that were present on the machine have been stolen, and change them immediately.
Roll Back to a Secure Version: It is currently recommended to use version 1.106.2 as the last stable and secure version before the attack occurred.

Why This News Matters

LiteLLM is a widely used tool, with over 92 million downloads per month, and is utilized by major companies such as NVIDIA, Netflix, and Okta. This incident once again highlights the fragility of supply chains in open-source projects, where a single attacker can gain access to the CI/CD pipeline and contaminate packages relied upon by thousands of developers and companies in a matter of minutes, making the monitoring of software package integrity a critical security necessity.