LiteLLM 1.107.0 on PyPI hid a credential stealer and backdoor

The incident stands out because the malicious code did not need LiteLLM to be running. By abusing the .pth mechanism that Python uses to load settings at startup, the attackers arranged for cook.py to execute whenever Python launched in the same environment. That widened the exposure well beyond the tool itself, and it is why the development team says affected users should not begin with a normal update: starting Python first would re-run the malicious files before they are deleted.

SafeDep's comparison of the distributed packages with the official GitHub repository found that the source code was clean, so the tampering happened somewhere between the repository and the published package. The stolen data was encrypted with a key held by the attacker and sent to an external server, making it hard to inspect what was taken. The backdoor's design, which fetched its server address from a GitHub file that the attacker could rewrite, also meant the payload could be swapped after installation.

The team has contained the damage but says it is still investigating how the attackers got in. Until that route is known, the practical advice is to treat any environment that installed 1.107.0 as potentially exposed, remove the files, rebuild the environment, and change passwords and API keys.