Version 1.107.0 of LiteLLM, the popular open-source proxy for routing requests across LLM providers, was compromised on PyPI today: the release carries a credential stealer and a backdoor that run every time Python starts on an infected machine. Why it matters: the stealer specifically targets AI provider keys — including the keys stored in a LiteLLM proxy’s own database — so anyone who installed it should treat every reachable credential as stolen.
October 21, 2026
What happened
Security researchers at Wiz, SafeDep, Socket and others reported on October 21, 2026 that the LiteLLM 1.107.0 release uploaded to PyPI at 11:39 UTC contains malicious code that is not present in the project’s GitHub source. All seven published wheels — Linux, macOS and Windows — are affected, and Wiz reports the project’s official Docker images carrying the v1.107.0, latest, main-latest and main-stable tags were also trojanized before being removed. PyPI has since removed the release. The most recent safe version is 1.106.2, and SafeDep says the 1.107.0 release candidates were clean.
How the malware works
Installing the package places three files — cook.pth, cook.py and sitecustomize.py — directly into site-packages. Python loads them automatically at interpreter startup, so the payload runs in every Python process on the host, even one that never imports LiteLLM. The stealer collects SSH keys, AWS, GCP and Azure credentials, CI/CD secrets, browser passwords, AI tool tokens, and the LLM provider keys stored in a LiteLLM proxy database, then encrypts the data and sends it to an attacker-controlled lookalike domain. The second file starts a background daemon that checks an attacker-controlled GitHub file every hour for a server address and downloads and runs whatever code it finds there; that repository has since been taken down.
How it got in
According to a statement from developer BerriAI reported by Wiz, the attack was carried out through three engineers’ GitHub accounts, apparently using stolen GitHub CLI OAuth tokens, and the involved tokens have been revoked. Wiz’s analysis says the payload was injected through a lookalike repository under a hyphenated variant of the project’s organization name, rather than through the public source tree.
Why it matters
LiteLLM sits in the middle of many teams’ AI stacks, holding the API keys for every provider they use — which makes its proxy database a uniquely valuable target. This is also the second PyPI compromise of the package this year, per OpenSourceMalware’s analysis. If version 1.107.0 was installed anywhere you control, researchers advise removing the three planted files, stopping the background daemon, and rotating every credential the host could reach — cloud keys, SSH keys and every provider key in the proxy — rather than simply upgrading and moving on.
Frequently asked questions
Which LiteLLM version is compromised?
Version 1.107.0 on PyPI, across all seven wheels, plus the official Docker images tagged v1.107.0, latest, main-latest and main-stable. Version 1.106.2 is the most recent safe release.
What does the malicious version steal?
It targets SSH keys, cloud credentials for AWS, GCP and Azure, CI/CD secrets, browser passwords, AI tool tokens, and the LLM provider API keys stored in a LiteLLM proxy’s database, exfiltrating them in encrypted form to an attacker-controlled domain.
What should I do if I installed LiteLLM 1.107.0?
Assume credentials on that host were stolen. Remove cook.pth, cook.py and sitecustomize.py from site-packages, kill the background Python daemon, and rotate every credential the machine could reach, including all provider keys stored in the LiteLLM proxy.
Sources: Wiz, SafeDep, Socket, OpenSourceMalware