LiteLLM compromised again: infostealer and RAT found in version 1.107.0 LiteLLM version 1.107.0, published to PyPI on October 21, 2026, was found compromised after an attacker exploited the `data = "cook"` directive in the project's `pyproject.toml` to inject three malicious files into compiled Python wheels and the official Docker image without touching the source repository. The package carries an infostealer that exfiltrates browser passwords, SSH private keys, cloud credentials, Kubernetes service account tokens, CI/CD secrets and developer-tool credentials, plus a RAT that polls attacker infrastructure every hour for commands; PyPI has quarantined version 1.107.0, but the Docker image `litellm/litellm:1.107.0` remains live on Docker Hub. Anyone who ran `pip install litellm==1.107.0` or pulled the `latest`, `main-latest` or `main-stable` tags should assume credentials are compromised and check for `/tmp/.pc_once_*` and `/tmp/remote_code_loader.lock`. On October 21, 2026, version 1.107.0 of LiteLLM a popular open source proxy that lets developers route requests across dozens of LLM providers was found to be compromised by an attacker who injected malicious code into its published Python wheels on PyPI. The official Docker image for the same version is also compromised. The package contains two distinct malicious components: an infostealer that exfiltrates credentials and secrets on first run, and a remote access trojan RAT that gives the attacker the ability to run arbitrary code on infected machines at any time. Anyone who ran pip install litellm==1.107.0 on any platform should assume credentials are compromised and check for /tmp/.pc once the exfil has already fired if this file exists and /tmp/remote code loader.lock the C2 daemon ran or is still running if this file exists . The same applies to anyone who ran the official Docker image litellm/litellm:1.107.0 , or pulled it via the latest , main-latest , or main-stable tags. Update: PyPI has now quarantined version 1.107.0. The compromised Docker image litellm/litellm:1.107.0 is still live on Docker Hub. What happened The attacker exploited a directive in LiteLLM's pyproject.toml to inject files into the compiled wheels without touching the source repository. tool.maturin data = "cook" module-name = "litellm.rust bridge. native" The data = "cook" directive tells maturin LiteLLM's Rust/Python build tool to bundle the contents of a directory named cook/ into the wheel's data section during the build. That directory does not exist in the source tarball or on GitHub. It was created in the compromised build environment and its contents were silently included in every compiled wheel that was then uploaded to PyPI. Three malicious files were injected into Python's site-packages on install: - cook.pth is a 12-byte file containing only import cook . Python processes .pth files in site-packages at every interpreter startup, so this causes cook.py to run automatically every time Python is invoked on the machine, with no further user action required. - cook.py contains the infostealer, heavily obfuscated as a single line that decompresses and executes a 61,000-byte payload. - sitecustomize.py is the RAT. Python also executes the file at interpreter startup, before any user code runs. This file spawns a background daemon that polls the attacker's infrastructure every hour for new commands to execute. What it steals Once the infostealer runs, it collects the following from the infected machine: - System information including hostname, username, OS version, running processes, and network interfaces - Saved passwords from Chromium-based browsers Chrome, Edge, Brave, Vivaldi, Opera including AES-decrypted password values, and browsing history from those same browsers - Firefox saved credentials - SSH private keys from ~/.ssh/ - Shell history from Bash, Zsh, and Fish - Cloud provider credentials including AWS credentials files and config, Azure authentication tokens and MSAL cache, and GCP application default credentials. It also queries the live instance metadata endpoints for AWS, GCP, and Azure to extract credentials available to the running instance. - Docker config files and Docker Swarm secrets - Kubernetes service account tokens - CI/CD secrets including GitLab runner configs, Jenkins admin passwords and master keys, and HashiCorp Vault tokens - Developer tool credentials and configuration files for Claude Code, Claude Desktop, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Amazon Q, Codex CLI, Aider, Continue, HuggingFace, and others - Git credentials, .npmrc , .pypirc , and pip config files - GPG private keys and TLS private keys - All environment variables from the current process and, on Linux, from every other running process via /proc/