LiteLLM 1.107.0 exposure check
On October 21, 2026 the litellm 1.107.0 release on PyPI installed a credential stealer and a remote code execution backdoor. Both start with any Python process on the host, even one that never imports litellm. PyPI removed the release the same day. Versions 1.106.2, 1.107.0rc1 and 1.107.0rc2 are clean.
1. Check your environment
Run pip freeze on the machine or in the container you want to check, and paste the output below. The check runs entirely in your browser. Nothing is uploaded or stored.
2. Check the host for the implant
A clean pip freeze today does not prove a host was never exposed. The implant leaves three files in site-packages and two marker files in /tmp. Run these on any host that had 1.107.0 installed:
ls "$(python3 -c 'import site; print(site.getsitepackages()[0])')" | grep -E '^(cook\.pth|cook\.py|sitecustomize\.py)$'
ls /tmp/.pc_once_72129118c59f5636c0bb /tmp/remote_code_loader.lock 2>/dev/null
Any match means the host ran the malicious code. Treat it as exposed even if litellm was later removed.
3. If exposed: remove, then rotate
The stealer reads credential stores and sends what it finds to the attacker. Removing the package stops new collection. It does not undo what was already taken. Work through every item that applies to the host.
- Remove the release: pip uninstall litellm, then delete any cook.pth, cook.py and sitecustomize.py left in site-packages.
- Reinstall a clean version: pip install "litellm==1.106.2". The pinned companions litellm-proxy-extras==0.4.110 and litellm-enterprise==0.1.78 are clean.
- Rebuild containers, images and CI caches that installed 1.107.0 between 11:40 and 13:40 UTC on October 21, 2026.
- Rotate every credential the stealer could read on that host. Checklist below, saved on this device.
What the malware does
From the SafeDep analysis of the release artifacts:
| Payload | Behaviour |
|---|---|
| cook.pth → cook.py | Runs in every Python process. Collects SSH keys, cloud credentials, CI and CD secrets, AI tool tokens, browser passwords and LLM provider keys from a LiteLLM proxy database. Encrypts and uploads them. |
| sitecustomize.py | Starts an hourly background daemon that reruns the stealer and downloads and runs code from an attacker server. |
The attacker GitHub account serving the backdoor was deleted about two hours after the release, so the daemon now finds no server. Hosts that ran it earlier could still have received second stage code.
Rotation done once beats rotation done twice
The Shuttlewright key rotation kit walks every hiding place one provider at a time: OpenAI, Anthropic and Google keys, where keys hide on your machine, and spend alerts so a stolen key costs less. Free checklist on the page, kits from $29.
Open the key rotation checklist