MAL-2026-2144 Malicious code in litellm (PyPI)

litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.

• cook.pth contains import cook.
• cook.py runs exec(zlib.decompress(base64.b64decode(...))), an info stealer (self-named "privcollect") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to http://www.litellm.dev/healthcheck. It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.
• sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, then downloads and executes code from http://<domain>/codepy (remote shell / dropper).

The same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.

litellm 1.107.0 is a Python LLM gateway/proxy library. No install-time or import-time code paths were observed that exfiltrate installer secrets, fetch and execute remote payloads, open a backdoor, redirect the installer's package manager, or distribute live third-party credentials. No lifecycle hooks performing network I/O, no.pth side effects beyond sys.path handling, and no credential-harvesting primitives against installer-owned paths (~/.aws, ~/.ssh, ~/.npmrc, browser or wallet stores) were found in the shipped artifact.

LiteLLM was compromised through trivy security scan in a GitHub workflow. Attackers uploaded malicious versions of LiteLLM to PyPI. The malicious code would exfiltrate sensitive secrets to an attcker controlled domain.

The OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.