Attack Details
On October 21, 2026, LiteLLM version 1.107.0 suffered a supply chain compromise when a malicious software package was published via the Python Package Index (PyPI) repository and official container channels. What is concerning about this attack is that the malicious software does not require calling the LiteLLM library within the application to work; rather, it is activated automatically as soon as the Python interpreter starts in an environment containing the compromised package.
Mechanism of Action and Threats
The attackers exploited Python startup files (such as cook.pth and sitecustomize.py) to execute malicious code in the background. This code collects sensitive credentials, including:
- API Keys for AI model providers.
- Cloud credentials and access tokens for development environments (CI/CD).
- Browser data and cookies.
- SSH and GPG keys.
The collected data is encrypted using the AES-256-CBC algorithm before being sent to a server controlled by the attackers. The compromised version also contains a custom "Loader" for Unix systems, capable of fetching and executing additional Python code remotely, giving attackers the flexibility to update their tools without needing to deploy a new package.
Why This News Matters
This breach poses a severe risk because LiteLLM is used as an intermediary gateway between applications and artificial intelligence models, meaning it possesses broad access privileges to the infrastructure. Given that activation occurs upon Python startup, developer workstations, CI/CD clients, and containers are all at risk even if LiteLLM functions are not directly used.
Response and Recovery Measures
Microsoft stresses that simply deleting the package is not enough to sanitize the environment. Organizations must take the following steps:
- Isolation and Investigation: Avoid running python or pip within suspected environments to prevent activating the malicious code, and use external scanning tools.
- Deep Cleaning: Ensure the removal of cook.pth, cook.py, and sitecustomize.py files from Python library paths.
- Credential Rotation: Consider all credentials that were available in the compromised environment to be breached, and immediately begin rotating API keys, access tokens, and passwords.
- Security Enhancement: Use hash-pinned lock files and rely on container digests instead of mutable tags.