---
id: MAL-2026-2144
aliases:
  - PYSEC-2026-2
title: Malicious code in litellm (PyPI)
summary: Malicious code in litellm (PyPI)
severity: critical
exploited: true
vendor: litellm
product: litellm
ecosystem: pip
affected:
  - litellm
published: '2026-03-24'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T14:30:33.719516315Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-2144'
references:
  - url: 'https://github.com/BerriAI/litellm/issues/24518'
  - url: 'https://github.com/BerriAI/litellm/issues/24512'
  - url: 'https://news.ycombinator.com/item?id=47501729'
  - url: >-
      https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign
  - url: 'https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/'
  - url: 'https://github.com/BerriAI/litellm/issues/47826'
  - url: 'https://pypi.org/project/litellm/1.107.0/'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-22T11:56:43.881Z'
---

## Overview

litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.

- cook.pth contains `import cook`.
- cook.py runs `exec(zlib.decompress(base64.b64decode(...)))`, an info stealer (self-named "privcollect") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to http://www.litellm.dev/healthcheck. It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.
- sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, then downloads and executes code from http://<domain>/codepy (remote shell / dropper).

The same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d588e32a0d0ef4ceb28300723f845056e9ea26b79358479186124cd37c13d394)
litellm 1.107.0 is a Python LLM gateway/proxy library. No install-time or import-time code paths were observed that exfiltrate installer secrets, fetch and execute remote payloads, open a backdoor, redirect the installer's package manager, or distribute live third-party credentials. No lifecycle hooks performing network I/O, no.pth side effects beyond sys.path handling, and no credential-harvesting primitives against installer-owned paths (~/.aws, ~/.ssh, ~/.npmrc, browser or wallet stores) were found in the shipped artifact.

## Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)
LiteLLM was compromised through trivy security scan in a GitHub workflow.
Attackers uploaded malicious versions of LiteLLM to PyPI. The malicious
code would exfiltrate sensitive secrets to an attcker controlled domain.

## Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)
The OpenSSF Package Analysis project identified 'litellm' @ 1.82.8 (pypi) as malicious.

It is considered malicious because:

- The package executes one or more commands associated with malicious behavior.


## Affected packages

- `litellm`

## Remediation

Refer to the advisory for the patched release.