{"type":"bundle","id":"bundle--04229e3e-7771-53bc-a376-d2801ae6be2d","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--33c1d44d-28c0-527e-9958-6f51dc74d862","created":"2026-10-21T13:50:46.653Z","modified":"2026-10-21T13:50:46.653Z","name":"LiteLLM 1.107.0 shipped a credential stealer on PyPI and the Docker latest tag","description":"All seven litellm 1.107.0 wheels uploaded to PyPI at 11:39 UTC on 2026-10-21 contained three extra files under litellm-1.107.0.data/purelib/ (cook.pth, cook.py, sitecustomize.py) that pip installs into site-packages root. cook.pth imports cook.py at every Python start; it collects host info, browser passwords, SSH and cloud credentials, CI and registry tokens, AI tool configs, other processes' environments and, when DATABASE_URL is set, LiteLLM's credential and model tables, then POSTs an encrypted bundle to www.litellm.dev. sitecustomize.py adds an hourly remote-code loader keyed off a GitHub dead-drop file. The v1.107.0 git tag is clean; the sdist pyproject.toml carries an injected maturin data = \"cook\" line. PyPI removed 1.107.0. The Docker v1.107.0 image and the floating latest, main-latest and main-stable tags on GHCR and Docker Hub share digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e and still resolved to it at 13:44 UTC.","aliases":["litellm 1.107.0","LiteLLM supply chain compromise October 2026","cook.pth","privcollect","ghcr.io/berriai/litellm:latest"],"first_seen":"2026-10-21T11:39:51Z","last_seen":"2026-10-21T13:44:00Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"AISLE: Compromised LiteLLM package found 3 minutes after release","url":"https://aisle.com/blog/litellm-11070-on-pypi-shipped-a-credential-stealer"},{"source_name":"BerriAI/litellm issue #47826: litellm 1.107.0 compromised","url":"https://github.com/BerriAI/litellm/issues/47826"},{"source_name":"LiteLLM v1.107.0 GitHub release","url":"https://github.com/BerriAI/litellm/releases/tag/v1.107.0"},{"source_name":"PyPI litellm release history","url":"https://pypi.org/project/litellm/"},{"source_name":"Docker Hub litellm/litellm tags","url":"https://hub.docker.com/r/litellm/litellm/tags"}]},{"type":"indicator","spec_version":"2.1","id":"indicator--92d30178-5ef9-515d-a496-29d44a479e08","created":"2026-10-21T13:50:35.539Z","modified":"2026-10-21T13:50:35.539Z","name":"LiteLLM 1.107.0 shipped a credential stealer on PyPI and the Docker latest tag: domain","description":"Defanged indicator mapped from a reviewed HOL Guard campaign record.","indicator_types":["malicious-activity"],"pattern_type":"stix","pattern":"[domain-name:value = 'www[.]litellm[.]dev']","valid_from":"2026-10-21T11:39:51Z"},{"type":"relationship","spec_version":"2.1","id":"relationship--14b1ec24-93d3-5d2b-bd5e-32b5ca98b1ad","created":"2026-10-21T13:50:35.539Z","modified":"2026-10-21T13:50:35.539Z","relationship_type":"uses","source_ref":"campaign--33c1d44d-28c0-527e-9958-6f51dc74d862","target_ref":"indicator--92d30178-5ef9-515d-a496-29d44a479e08"}]}