LiteLLM release pipeline hacked, malicious packages distribute info-stealing malware

Attackers pushed tainted Python wheels and Docker images to PyPI and container registries, affecting Windows, Linux and macOS systems

By LineZotpaper

Published22 October 2026

Read Time2 min

Hackers compromised the release pipeline of LiteLLM, a popular open-source AI gateway, pushing malicious PyPI packages and Docker images that steal credentials, secrets and environment variables. The supply-chain attack, detected on October 21, affected version 1.107.0 across all platforms, though the project's private enterprise customers were not impacted.

LiteLLM, an open-source Python SDK and AI gateway used by companies including NVIDIA, Netflix, AT&T and Okta, disclosed that its release pipeline was compromised on October 21, allowing a threat actor to push version 1.107.0 to PyPI and the Docker registry containing compiled malware. The project's maintainer confirmed that the malicious release "contained compiled malware which steals credentials and loads remote-code execution tools."

According to a post-mortem, the attacker modified only the installation package, placing three malicious files, cook.pth, cook.py, and sitecustomize.py, in the Python library directory. Security researchers at Socket and Endor Labs noted that Python executes these files during normal startup, triggering the payload before the application runs each time Python launches. Even running Python or pip to investigate an infected system would activate the malware.

The malware targeted a broad range of sensitive data, including cloud and deployment credentials for AWS, Azure, Google Cloud, Kubernetes and Docker; AI authentication files and LiteLLM's stored provider credentials; developer secrets such as Git, GitHub, npm, PyPI and CI/CD credentials; environment variables, shell histories, and browser saved logins, cookies and payment data. The stolen information is encrypted with AES-256-CBC, protected by an RSA-4096 key, and exfiltrated to litellm[.]dev/healthcheck. One malicious file, sitecustomize.py, launches a detached loader that checks a GitHub-hosted pointer hourly to download and execute arbitrary Python code from an external server.

Multiple application security firms detected the attack within six minutes of publication and analysed the payload. The malicious artifacts, all seven PyPI wheels from 11:39:51 to 13:23 UTC, and Docker images on Docker Hub and GHCR, have been removed. The project recommends affected users stop compromised deployments, inspect environments without launching Python, isolate and rebuild from clean backups, and rotate all exposed secrets. The recommended recovery version is LiteLLM 1.106.2, the last known clean release before the attack.

This is not the first breach for LiteLLM. In March, the TeamPCP hacking group published malicious versions on PyPI after compromising the Aqua Security Trivy vulnerability scanner used in LiteLLM's CI/CD pipeline.

Analysis

Why This Matters

LiteLLM is a critical infrastructure component for AI deployments at major enterprises. Compromised packages could give attackers persistent access to cloud environments, AI model credentials and internal secrets.
The six-minute detection window shows security vendors are watching, but the damage, secret rotation and system rebuilds, is already incurred.
Similar supply-chain attacks are on the rise as attackers target widely-used open-source projects to maximise reach.

Background

LiteLLM is an open-source Python SDK and AI gateway that provides a common API to access AI models from multiple providers. With 61,800 GitHub stars and 92 million monthly PyPI downloads, it is a high-value target for supply-chain attackers. The project was previously breached in March 2026, when the TeamPCP group used a compromised CI/CD tool to push malicious versions.

Key Perspectives

Project maintainers: They acted swiftly to remove the malicious artifacts and published detailed post-mortem guidance. They emphasised that private enterprise installations were unaffected and recommended version 1.106.2 for recovery. However, the recurrence of a pipeline compromise raises questions about the security posture of the release process.

Security researchers (Socket, Endor Labs): They analysed the payload within minutes of its release, highlighting the stealthy technique of using .pth and sitecustomize.py files that execute before any application code. Their rapid detection helped limit the exposure window.

Users and downstream organisations: Companies running LiteLLM must assume all secrets exposed to affected environments are compromised. The need to manually inspect systems without launching Python and to rebuild from clean backups is a significant operational burden.

What to Watch

Whether additional payloads or backdoors are discovered in the compromised images beyond those already reported.
The project's response to hardening its CI/CD pipeline against future compromises, especially after a second breach.
Any disclosure of specific user data or access logs that could indicate the scope of the attacker's reach.

Sources

LiteLLM release pipeline hacked to distribute info-stealer malware · BleepingComputer

Checked

12 claims in this story checked against 1 source: 7 supported.

Show each claim

SupportedLiteLLM’s release pipeline was hacked.BleepingComputer: “The project says that the release pipeline was compromised on October 21”
SupportedMalicious LiteLLM packages and Docker images contained malware that steals credentials and secrets.BleepingComputer: “Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.”
SupportedVersion 1.107.0 affected Windows, Linux and macOS systems.BleepingComputer: “The supply-chain attack affected all PyPI wheels (.whl installation packages) for LiteLLM version 1.107.0, impacting Windows, Linux, and macOS systems.”
Partly supportedThe attack was detected on October 21.BleepingComputer: “The project says that the release pipeline was compromised on October 21 and a threat actor pushed version 1.107.0 to the Docker registry and PyPI.”
Partly supportedThe project’s private enterprise customers were not impacted.BleepingComputer: ““This version contained compiled malware which steals credentials and loads remote-code execution tools,” the maintainer says, adding that customers running the private enterprise were not impacted.”
SupportedThe maintainer said the release “contained compiled malware which steals credentials and loads remote-code execution tools.”BleepingComputer: ““This version contained compiled malware which steals credentials and loads remote-code execution tools,” the maintainer says”
Partly supportedPython executes the three malicious files during normal startup, before the application runs.BleepingComputer: ““During normal startup, Python processes executable .pth lines and then attempts to import sitecustomize,” Socket researchers explain . Endor Labs notes that this way the payloads are executed before the application every time Python is launched in the environment.”
SupportedThe malware targeted cloud, AI, developer and browser credentials, as well as environment variables and shell histories.BleepingComputer: “The malware targeted the following data: Cloud and deployment credentials: AWS, Azure, Google Cloud, Kubernetes, Docker, and infrastructure-management secrets. AI credentials and configuration: Authentication files for AI development tools, plus LiteLLM’s stored provider credentials and model settings. Developer secrets and private keys: Git, GitHub, npm, PyPI, and CI/CD credentials; .env files; SSH, GPG, and TLS keys. Browser data: Saved login, cookie, autofill/payment, and browsing-history databases. Host and runtime data: Environment variables, shell and application histories, and system an”
SupportedThe stolen data was encrypted using AES-256-CBC with an RSA-4096 key and uploaded to litellm[.]dev/healthcheck.BleepingComputer: “The stolen data is encrypted using an AES-256-CBC key that is encrypted with an RSA-4096 key and then uploaded to ‘litellm[.]dev/healthcheck’”
Partly supportedThe detached loader downloads and executes arbitrary Python code from an external server.BleepingComputer: “One of the malicious files, sitecustomize.py, launches a detached loader that checks a GitHub-hosted pointer every hour and downloads Python from an external server for execution on the host.”
Partly supportedAll seven PyPI wheels and the Docker images were removed.BleepingComputer: “PyPI: litellm==1.107.0: all seven wheels, live from 11:39:51 to 13:23 UTC Docker Hub: v1.107.0, latest, main-latest, and main-stable: pointed to compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTC”
SupportedLiteLLM 1.106.2 was the last known clean release and the recommended recovery version.BleepingComputer: “Currently, the recommended recovery version is LiteLLM 1.106.2, which is the latest clean release before the attack.”