LiteLLM release pipeline hacked to distribute info-stealer malware

A supply-chain attack compromised the release pipeline of LiteLLM on October 21, allowing an unauthorized actor to publish poisoned software artifacts containing info-stealing malware to both PyPI and container registries. As detailed in BleepingComputer's report, the breach pushed infected packages under version 1.107.0 across Windows, Linux, and macOS platforms. The distributed payload was engineered to harvest environment variables, cloud credentials, AI provider keys, developer configuration files, and system databases, while installing a secondary loader for arbitrary remote code execution on affected machines.

This analysis details the exact sequence of the release pipeline compromise, the technical mechanics of the malicious Python bootstrap files, the operational impact on engineering teams, and the required recovery protocol. It is intended for software architects, security engineers, DevOps administrators, and platform teams who deploy the open-source LiteLLM gateway or run its official container images inside enterprise infrastructure. The guidance outlines remediation boundaries, explaining why simple directory deletions remain insufficient to clean an affected runtime environment.

LiteLLM pipeline hacked to distribute: what actually changed

The threat actor gained unauthorized access to the project's build and publishing pipeline, pushing version 1.107.0 directly to PyPI and multiple container registries rather than altering the underlying Git codebase. On PyPI, all seven pre-compiled wheel packages for litellm 1.107.0 were published at 11:39:51 UTC and remained live until 13:23 UTC on October 21. On Docker Hub, tags for v1.107.0, latest, main-latest, and main-stable pointed to compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e between 11:46:56 and 14:20 UTC before maintainers revoked them.

Similar poisoning took place across the GitHub Container Registry under the berriai organization, exposing the primary litellm repository, litellm-database, and litellm-non_root containers between 11:46:56 UTC and 13:51 UTC. Maintainers stated that customers running the private enterprise tier were not impacted by the incident. Security firms detected the anomalous distribution within six minutes of release, observing that the application logic remained unaltered while the distribution wheels carried three auxiliary injection files named cook.pth, cook.py, and sitecustomize.py inside the standard library path.

LiteLLM pipeline hacked to distribute: how it works

The intrusion leveraged standard Python runtime bootstrap mechanics to achieve automatic execution without requiring an explicit application import. When Python initializes in an infected environment, it scans for path configuration files, causing cook.pth to run executable statements and immediately load sitecustomize.py before the application starts. Security researchers at Socket and Endor Labs confirmed that this sequence forced the malware to execute whenever Python started, meaning administrative attempts to run pip or inspect packages with python CLI commands triggered the payload anew.

Once activated, the malware systematically collected sensitive host data, developer secrets, cloud credentials for AWS, Azure, Google Cloud, Docker, and Kubernetes, alongside LiteLLM model provider tokens and .env files. The gathered archive was encrypted locally using an AES-256-CBC key protected by an RSA-4096 envelope before exfiltration to an endpoint at litellm[.]dev/healthcheck. In addition, sitecustomize.py launched an independent, detached background loader that polled an external GitHub-hosted pointer hourly, designed to pull down and run external Python binaries for persistent remote access.

LiteLLM pipeline hacked to distribute: why it matters now

The incident highlights severe systemic risks across the AI engineering toolchain, where downstream systems grant high-privilege access keys directly to central model routing gateways. LiteLLM serves as a unified abstraction layer connecting internal software to multiple third-party model providers, meaning installations routinely hold live production secrets for enterprise cloud environments and model APIs. Because the malicious package gained access to both developer workstations and automated CI/CD environments, unauthorized key exfiltration provides attackers with wide lateral movement opportunities across cloud infrastructure.

This event also represents the second major supply-chain security breach for the LiteLLM project during 2026. The project suffered a previous breach in March, when the TeamPCP hacking collective published poisoned packages to PyPI after compromising Aqua Security's Trivy vulnerability scanner inside LiteLLM's automated CI/CD pipeline. The recurrence of pipeline poisoning demonstrates that automated release processes and packaging pipelines remain a primary target for actors seeking unauthenticated footholds inside modern enterprise software estates.

LiteLLM pipeline hacked to distribute: who is affected

The compromise affects any developer workstation, virtual machine, or container environment that downloaded LiteLLM version 1.107.0 or pulled updated Docker tags during the October 21 exposure window. Because the repository commands 61,800 GitHub stars and records roughly 92 million monthly downloads on PyPI, adoption spans independent engineers and major enterprise organizations including NVIDIA, Netflix, AT&T, and Okta. Any system pulling the latest or main-stable container image tags between 11:46:56 UTC and 14:20 UTC received the compromised image index.

Engineering teams running private enterprise versions were exempt from the package poisoning, according to project maintainers. However, developers who initiated standard pip install litellm commands or rebuilt automated container pipelines during the 103-minute PyPI availability window received malicious wheels across Windows, Linux, and macOS platforms. Even instances where installation aborted early or where engineers ran local diagnostics using pip list or python commands within the tainted virtual environment triggered the automated payload execution.

LiteLLM pipeline hacked to distribute: what to watch

Organizations must treat any environment that fetched version 1.107.0 as fully breached, requiring immediate isolation, shutdown, and credential revocation across all services touched by those machines. Project maintainers advised that simply deleting the LiteLLM installation folder leaves behind the persistent background loader and library startup scripts. The safe engineering remediation path requires terminating affected container instances, tearing down compromised virtual environments, rotating all cloud credentials, SSH keys, TLS certificates, and API tokens, and redeploying from LiteLLM version 1.106.2.

Security teams should audit internal network traffic for outbound POST requests directed toward litellm[.]dev/healthcheck, checking egress proxies for unusual data transfers during and after the October 21 window. Operations groups should also inspect runtime hosts for rogue background processes running external Python binaries downloaded by the detached loader script. Going forward, engineering teams must pin exact package hashes, utilize isolated staging environments for dependencies, and avoid floating Docker tags like latest in production deployments.