LiteLLM released v1.107.0 to PyPI and Docker via a compromised release pipeline, enabling a credential-stealing malware with remote-code execution capabilities.

Three artifacts were added—cook.pth, cook.py, and sitecustomize.py—where sitecustomize.py runs at Python startup to load the payload, triggering credential collection and exfiltration.

The infostealer harvests credentials and secrets from multiple sources, including browser data (Chrome, Firefox, Edge, Safari), AWS credentials, cloud provider keys (Google Cloud, Azure), API keys for OpenAI and other LLMs, SSH private keys, GPG keys, and shell history, then encrypts data with AES-256-CBC wrapped by RSA-4096 and exfiltrates to a threat actor–controlled server.

The incident underscores the need to verify both the legitimate source and the delivered artifacts, and to scrutinize the environments where they run, since safe source code does not guarantee safe distributed artifacts.

Longer-term recommendations call for treating build configuration as code, auditing startup hooks in dependencies, and enforcing strict pinning and provenance verification to prevent future supply-chain compromises.

Security notes reference a potential link to a prior March 2026 TeamPCP activity, though attribution is not confirmed and evidence remains inconclusive.

Affected users should revoke and replace sensitive logins and keys using a clean device and revert to a previous secure version of the software.

Advisories advocate pinning exact versions or image digests and rebuilding environments from scratch; a separate vulnerability note indicates a public disclosure on October 27, 2026, already fixed in an embargoed enterprise release.

An initial 24-hour plan includes containment, rotating keys and tokens, exposure scoping, backdoor checks, and post-incident hardening such as cooldown policies and using pinned hashes instead of floating tags.

LiteLLM states the incident is contained and provides remediation guidance; affected users should rotate credentials even if they updated after the pull.

Credential rotation is mandatory across instances, provider keys, master and virtual keys, databases, and any secrets in affected processes; checking for cook.pth can help verify, but its absence does not guarantee safety.

Vendor risk implications emphasize that a single unpinned install or floating-tag pull can expose provider keys and cloud credentials; vendors should confirm LiteLLM usage and ensure isolation, rebuilding, and credential rotation where applicable.