A compromised release of LiteLLM 1.107.0 on PyPI installs a credential stealer and a remote code execution backdoor. All seven wheels, covering Linux, macOS and Windows, install three files into site-packages. Two of them run whenever any Python process starts on the host, even one that never imports litellm. The upstream GitHub source does not contain them, and PyPI has since removed the release. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean, as are the companion packages litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78.
The stealer, cook.py, collects SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and LLM provider keys stored in a LiteLLM proxy database. It encrypts the data and sends it to www.litellm[.]dev. A second file, sitecustomize.py, starts a background daemon that runs every hour. The daemon reads a server address from a GitHub file, reruns the stealer, and downloads and executes code from that server.
The implant entered through a single added line in the build configuration of the 1.107.0 source distribution. That line copies a hidden folder into the wheel, and the folder is absent from the source distribution. The release also does not match its tag, v1.107.0, and no public GitHub Actions run built or published it. Safe Dep assesses with moderate to high confidence that Berri AI's private release pipeline built the wheels from an attacker-modified source. Only the company's pipeline logs can confirm how the compromise happened.
Source: Hacker News · Summarized by HeadlinesBriefing