LiteLLM supply chain attacked again: malicious 1.107.0 wheels steal credentials
bibryam · x · 2026-10-22
JFrog Security Research found all seven PyPI wheels for litellm 1.107.0 (macOS, Linux, musl, Windows) contain malicious code — the second documented hijack of LiteLLM in 2026.
Key facts:
- The payload adds cook.pth, cook.py, and sitecustomize.py, executing at Python startup even if the app never imports litellm; it steals a broad set of credentials and opens an hourly remote-code-execution channel
- The official litellm/litellm:1.107.0 Docker image is also affected
- The source sdist lacks the payload files, so reviewers checking only source, Git tags, or sdists would miss it; the added data = "cook" setting in pyproject.toml is a tell
- PyPI has removed 1.107.0 and Docker Hub pulled the affected image and mutable tags (latest, main-latest, main-stable); systems that pulled them should be treated as exposed
- Community tracking in LiteLLM issue #47826
More from coding & agent
- Open-source huashu-motion turns Claude Code into a launch-film studio, 1.3k stars — AlchainHust · 2026-10-22
- Thinking Machines Ships StableReinforce, a Loss That Keeps Off-Policy RL From Collapsing — LiTianleli · 2026-10-22
- phoneuse launches MCP/API giving AI agents their own cloud Android and iPhone devices — Rasmic · 2026-10-22
- 15-person Keenable beats $350M-funded Exa atop Vals web search index at 49.1% — EXM7777 · 2026-10-22
- Rork's $1800/month Max tier offers 10,005 credits for tokenmaxxing Opus — rudrank · 2026-10-22
- AI Agents Spent $47.35 Overnight From a Single Prompt With No Numbers — aakashgupta · 2026-10-22