In a critical supply chain security advisory published on October 21, 2026, software security analysts from SafeDep and independent threat research teams confirmed that version 1.107.0 of LiteLLM, a widely adopted open-source AI routing and proxy library, was compromised on the Python Package Index (PyPI). Threat actors successfully injected malicious code into the published release wheels and Docker images, transforming infected developer workstations and continuous integration (CI) environments into active credential harvesting nodes.
The attack demonstrated sophisticated evasion techniques aimed at bypassing standard code-review workflows. The public source code hosted in LiteLLM's GitHub repository showed no malicious commits or altered logic. Instead, the attackers compromised the maintainer release pipeline, modifying the pyproject.toml build configuration within the published source distribution to instruct the Maturin packaging tool to bundle an unindexed directory named 'cook' into the compiled binary wheels.
Once installed via standard pip workflows, the package placed two persistent trapdoors into the host's Python site-packages directory: cook.pth and sitecustomize.py. Under standard Python startup behavior, the interpreter automatically evaluates .pth configuration files and imports sitecustomize upon initialization. Consequently, the malicious code executed every time any Python process started on the host machine—regardless of whether LiteLLM was ever explicitly imported or called by the application.
Upon execution, the infostealer payload scoured local environment variables, cloud configuration profiles, and shell history to harvest sensitive credentials. Compromised secrets included AWS access keys, Azure tokens, Google Cloud service accounts, and commercial API credentials for OpenAI, Anthropic, and Cohere. The stolen telemetry was encrypted and transmitted via HTTP POST requests to an attacker-controlled lookalike domain, litellm[.]dev. In addition to data theft, the package spawned a background daemon attempting to establish an interactive Remote Access Trojan (RAT) connection.
PyPI security staff responded by quarantining version 1.107.0, and LiteLLM maintainers removed the corresponding Docker tags while rotating release credentials. Security teams have advised any engineering organization that executed pip install litellm==1.107.0 to treat the host as completely compromised, verify the presence of indicators of compromise such as /tmp/.pc_once_* or /tmp/remote_code_loader.lock, immediately rotate all accessible API keys and cloud secrets, and revert to a verified release.