Threat feed

LiteLLM 1.107.0 backdoor

LiteLLM 1.107.0 supply-chain compromise: Python startup-hook credential stealer and remote-code loader run in any Python process

Posted · Updated · Spectrum Delta Research Team

Summary

Attackers with stolen maintainer GitHub credentials redirected LiteLLM's release workflow to a lookalike repo (Berri-AI/litellm) and published litellm==1.107.0 to PyPI and Docker on Oct 21, planting Python startup hooks (cook.pth/cook.py, sitecustomize.py) that execute in ANY Python process without importing litellm — a credential stealer (PRIVCOLLECT) exfiltrating cloud, AI-provider, browser and SSH secrets to litellm[.]dev, plus a detached remote-code loader whose second stage has not been observed firing. Microsoft's deep-dive (Oct 23) ships exact Defender detections and implant hashes; LiteLLM states the impacted releases are pulled and treats any environment that ran Python with the implant as compromised.

Breakdown

Adversary

Unknown

Procedures (5)

  1. Startup-hook implant files planted in site-packages (cook.pth/cook.py/sitecustomize.py)

    Malicious wheel plants Python startup-hook files in site-packages outside the litellm application directory

    • T1195.002Supply Chain Compromise: Compromise Software Supply Chain

    Logs

    • Linux auditd · File-create in site-packages (cook.pth, cook.py, sitecustomize.py), /tmp markers and .pc_e_*/.pc_sq_* staging; process-create for openssl and python -c
    • Microsoft Defender for Endpoint / Sysmon · DeviceFileEvents (SHA256), DeviceProcessEvents (python -c, openssl), DeviceNetworkEvents (RemoteUrl to litellm.dev)

    Detectors

    • Microsoft Defender (AV / MDE / Defender for Cloud) · Trojan:PyPI/Stealer.SA, Trojan:PyPI/LiteLlmSupplyChain.A/B, Backdoor:PyPI/LiteLlmSupplyChain.C; MDE: Suspicious script launched, Suspicious network connection observed, Possible theft of passwords, Suspicious OpenSSL command launch; TVM-2026-0003
    • Sigma (SigmaHQ PR #6503) · DNS/proxy litellm.dev indicators; cook.pth/site-packages and /tmp-marker file-creation rules (Linux/macOS/Windows)
Click to expand remaining (4) procedures

  1. Exfiltration POST to litellm[.]dev/healthcheck (AES+RSA packaged tar)

    Collector exfiltration POST to litellm[.]dev/healthcheck

    • T1041Exfiltration Over C2 Channel

    Logs

    • Web proxy / DNS logs · Proxy cs-host and DNS queries for litellm.dev; dead-drop and /codepy fetches
    • Microsoft Defender for Endpoint / Sysmon · DeviceFileEvents (SHA256), DeviceProcessEvents (python -c, openssl), DeviceNetworkEvents (RemoteUrl to litellm.dev)

    Detectors

    • Microsoft Defender (AV / MDE / Defender for Cloud) · Trojan:PyPI/Stealer.SA, Trojan:PyPI/LiteLlmSupplyChain.A/B, Backdoor:PyPI/LiteLlmSupplyChain.C; MDE: Suspicious script launched, Suspicious network connection observed, Possible theft of passwords, Suspicious OpenSSL command launch; TVM-2026-0003
    • Sigma (SigmaHQ PR #6503) · DNS/proxy litellm.dev indicators; cook.pth/site-packages and /tmp-marker file-creation rules (Linux/macOS/Windows)

  2. Collector staging: openssl .pc_e_* packaging and inline LiteLLM proxy-DB queries

    Collector staging on the endpoint: openssl .pc_e_* packaging and inline LiteLLM proxy-DB queries

    • T1005Data from Local System

    Logs

    • Linux auditd · File-create in site-packages (cook.pth, cook.py, sitecustomize.py), /tmp markers and .pc_e_*/.pc_sq_* staging; process-create for openssl and python -c
    • Microsoft Defender for Endpoint / Sysmon · DeviceFileEvents (SHA256), DeviceProcessEvents (python -c, openssl), DeviceNetworkEvents (RemoteUrl to litellm.dev)

    Detectors

    • Microsoft Defender (AV / MDE / Defender for Cloud) · Trojan:PyPI/Stealer.SA, Trojan:PyPI/LiteLlmSupplyChain.A/B, Backdoor:PyPI/LiteLlmSupplyChain.C; MDE: Suspicious script launched, Suspicious network connection observed, Possible theft of passwords, Suspicious OpenSSL command launch; TVM-2026-0003

  3. Detached remote-code loader (lock file, GitHub dead-drop pointer, /codepy execution)

    sitecustomize.py detached remote-code loader with GitHub dead-drop pointer

    • T1105Ingress Tool Transfer

    Logs

    • Linux auditd · File-create in site-packages (cook.pth, cook.py, sitecustomize.py), /tmp markers and .pc_e_*/.pc_sq_* staging; process-create for openssl and python -c
    • Microsoft Defender for Endpoint / Sysmon · DeviceFileEvents (SHA256), DeviceProcessEvents (python -c, openssl), DeviceNetworkEvents (RemoteUrl to litellm.dev)
    • Web proxy / DNS logs · Proxy cs-host and DNS queries for litellm.dev; dead-drop and /codepy fetches

    Detectors

    • Microsoft Defender (AV / MDE / Defender for Cloud) · Trojan:PyPI/Stealer.SA, Trojan:PyPI/LiteLlmSupplyChain.A/B, Backdoor:PyPI/LiteLlmSupplyChain.C; MDE: Suspicious script launched, Suspicious network connection observed, Possible theft of passwords, Suspicious OpenSSL command launch; TVM-2026-0003

  4. Implant artifact matching: SHA-256 set, exfil domain, markers, dead-drop URL (IOC)

    Implant artifact matching (IOC procedure)

    • T1195.002Supply Chain Compromise: Compromise Software Supply Chain

    Logs

    • Linux auditd · File-create in site-packages (cook.pth, cook.py, sitecustomize.py), /tmp markers and .pc_e_*/.pc_sq_* staging; process-create for openssl and python -c
    • Microsoft Defender for Endpoint / Sysmon · DeviceFileEvents (SHA256), DeviceProcessEvents (python -c, openssl), DeviceNetworkEvents (RemoteUrl to litellm.dev)
    • Web proxy / DNS logs · Proxy cs-host and DNS queries for litellm.dev; dead-drop and /codepy fetches

    Detectors

    • Microsoft Defender (AV / MDE / Defender for Cloud) · Trojan:PyPI/Stealer.SA, Trojan:PyPI/LiteLlmSupplyChain.A/B, Backdoor:PyPI/LiteLlmSupplyChain.C; MDE: Suspicious script launched, Suspicious network connection observed, Possible theft of passwords, Suspicious OpenSSL command launch; TVM-2026-0003
    • Sigma (SigmaHQ PR #6503) · DNS/proxy litellm.dev indicators; cook.pth/site-packages and /tmp-marker file-creation rules (Linux/macOS/Windows)

Indicators of compromise

Hunt only

Seven litellm-1.107.0 wheel SHA-256s (macOS x86_64/arm64, manylinux aarch64/x86_64, musllinux aarch64/x86_64, win_amd64) and Docker tags v1.107.0/latest/main-latest/main-stable (11:46-14:20 UTC Oct 21) — exposure scoping for affected installs, assessed 2026-10-23; attacker identity unknown; dead-drop hosted under GitHub account letters9813.

Durable

Implant artifacts: cook.pth SHA-256 7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb and 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d; cook.py 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25 and 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea; sitecustomize.py 34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa and b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465; exfil domain litellm[.]dev / www.litellm.dev (POST /healthcheck, application/octet-stream, X-SHA256 header); dead-drop raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt; markers /tmp/.pc_once_72129118c59f5636c0bb, /tmp/remote_code_loader.lock, .pc_e_*/.pc_sq_* prefixes; env PRIVCOLLECT_ACTIVE; python -c patterns LiteLLM_CredentialsTable/credential_values and LiteLLM_ProxyModelTable/litellm_params with query_raw.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of LiteLLM 1.107.0 backdoor? Bring them to the community.

Discuss in the Tradecraft Slack