critical severityConfidence highHistorical record

LiteLLM 1.107.0 shipped a credential stealer on PyPI and the Docker latest tag

All seven litellm 1.107.0 wheels uploaded to PyPI at 11:39 UTC on 2026-10-21 contained three extra files under litellm-1.107.0.data/purelib/ (cook.pth, cook.py, sitecustomize.py) that pip installs into site-packages root. cook.pth imports cook.py at every Python start; it collects host info, browser passwords, SSH and cloud credentials, CI and registry tokens, AI tool configs, other processes' environments and, when DATABASE_URL is set, LiteLLM's credential and model tables, then POSTs an encrypted bundle to www.litellm.dev. sitecustomize.py adds an hourly remote-code loader keyed off a GitHub dead-drop file. The v1.107.0 git tag is clean; the sdist pyproject.toml carries an injected maturin data = "cook" line. PyPI removed 1.107.0. The Docker v1.107.0 image and the floating latest, main-latest and main-stable tags on GHCR and Docker Hub share digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e and still resolved to it at 13:44 UTC.

Also tracked as litellm 1.107.0 · LiteLLM supply chain compromise October 2026 · cook.pth · privcollect · ghcr.io/berriai/litellm:latest

First observed
Oct 21, 2026
Last observed
Oct 21, 2026
Last reviewed
Oct 21, 2026
Tracking ended
Oct 21, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Payload analysis comes from AISLE and the public incident report (issue #47826). The claim that the release was built from the lookalike repository Berri-AI/litellm is the reporter's finding, not yet confirmed by BerriAI. HOL verified registry tag digests directly but did not unpack the Docker image. Number of affected installs is unknown.

  • Installs pinned to 1.106.2 or earlier, and Docker images pinned to version tags other than v1.107.0, are reported clean
  • The 1.107.0 sdist lacks the payload files though its pyproject.toml is tampered
  • Installs after PyPI removal resolve to 1.106.2
  • This is not a remotely exploitable flaw in LiteLLM code; impact is on machines that installed the poisoned build
  • A passing cosign verify on the v1.107.0 image is not evidence of a clean image

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

No Guard coverage mapping is published for this record.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Update

    GitHub repository hosting the stage-2 dead-drop file is created.

  2. First observed

    litellm 1.107.0 wheels with credential stealer uploaded to PyPI.

  3. Disclosure

    AISLE dependency firewall flags the first malicious wheel.

  4. Update

    Docker latest, main-latest and main-stable tags move to the v1.107.0 image digest.

  5. Disclosure

    Public incident report opened on BerriAI/litellm.

  6. Registry action

    PyPI has removed 1.107.0; latest resolves to 1.106.2. Docker floating tags still point at the infected digest.

Publication clock: 2.1 hours from reviewed disclosure timestamp to HOL publication; 12-hour critical target; within target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • litellm@1.107.0pypipackage
  • ghcr.io/berriai/litellm@v1.107.0, latest, main-latest, main-stable @ sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339edockerpackage

Indicators

Published values are defanged so nothing here is copy-paste executable. These are inert text, never links.

8 indicators are recorded as not defanged. Treat them as live.

  • domainhigh confidencedefanged
    www[.]litellm[.]dev
  • urlhigh confidencedefanged
    hxxps://raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt
  • file hashhigh confidencenot defanged
    1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e
  • file hashhigh confidencenot defanged
    462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7
  • file hashhigh confidencenot defanged
    668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6
  • file hashhigh confidencenot defanged
    1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00
  • file hashhigh confidencenot defanged
    c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054
  • file hashhigh confidencenot defanged
    7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d
  • file hashhigh confidencenot defanged
    0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a
  • file hashhigh confidencenot defanged
    12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484

Sources

Every claim on this record is traceable to the sources below.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-385E1963