{"id":"MAL-2026-2144","aliases":["PYSEC-2026-2"],"title":"Malicious code in litellm (PyPI)","summary":"Malicious code in litellm (PyPI)","severity":"critical","exploited":true,"vendor":"litellm","product":"litellm","ecosystem":"pip","affected":["litellm"],"published":"2026-03-24","updated":"2026-10-29","sourceUpdated":"2026-10-29T14:30:33.719516315Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-2144","references":[{"url":"https://github.com/BerriAI/litellm/issues/24518"},{"url":"https://github.com/BerriAI/litellm/issues/24512"},{"url":"https://news.ycombinator.com/item?id=47501729"},{"url":"https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"},{"url":"https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/"},{"url":"https://github.com/BerriAI/litellm/issues/47826"},{"url":"https://pypi.org/project/litellm/1.107.0/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-22T11:56:43.881Z","slug":"MAL-2026-2144","body":"## Overview\n\nlitellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.\n\n- cook.pth contains `import cook`.\n- cook.py runs `exec(zlib.decompress(base64.b64decode(...)))`, an info stealer (self-named \"privcollect\") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to http://www.litellm.dev/healthcheck. It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.\n- sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, then downloads and executes code from http://<domain>/codepy (remote shell / dropper).\n\nThe same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d588e32a0d0ef4ceb28300723f845056e9ea26b79358479186124cd37c13d394)\nlitellm 1.107.0 is a Python LLM gateway/proxy library. No install-time or import-time code paths were observed that exfiltrate installer secrets, fetch and execute remote payloads, open a backdoor, redirect the installer's package manager, or distribute live third-party credentials. No lifecycle hooks performing network I/O, no.pth side effects beyond sys.path handling, and no credential-harvesting primitives against installer-owned paths (~/.aws, ~/.ssh, ~/.npmrc, browser or wallet stores) were found in the shipped artifact.\n\n## Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)\nLiteLLM was compromised through trivy security scan in a GitHub workflow.\nAttackers uploaded malicious versions of LiteLLM to PyPI. The malicious\ncode would exfiltrate sensitive secrets to an attcker controlled domain.\n\n## Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)\nThe OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n\n\n## Affected packages\n\n- `litellm`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}