LiteLLM PyPI release stole SSH keys and AI API keys via .pth backdoor
arpit_bhayani · x · 2026-10-22
A malicious LiteLLM 1.107.0 release on PyPI installed a credential stealer and backdoor, and engineer arpitbhayani broke down the full attack chain:
- How it got in: the attacker added a single build-config line (data = "cook") that bundled three extra malicious files into the published package. The public GitHub repo looked clean — only the shipped artifact was malicious.
- Why it ran without imports: a cook.pth file in site-packages executes on every Python startup, so nearly any process — your app, pip, your editor, CI jobs — could trigger the stealer.
- What it stole: SSH keys, shell history, AWS/Azure/GCP/K8s/GitHub credentials, Claude Code/Cursor/Codex keys, saved browser passwords, environment variables, and LLM API keys in LiteLLM proxy databases.
- Exfiltration: data was encrypted and uploaded to a /healthcheck endpoint to blend in with routine traffic.
Mitigations: pin versions with hashes, give new releases time to be scrutinized, and inspect the actual artifacts you install. Auditing the repository alone is no longer enough.
Related event: LiteLLM 1.107.0 Poisoned with Credential Stealer and RCE Backdoor(13 posts)→
More from Safety
- Eric Jang: robots need open SDKs so the community can secure them at scale — ericjang11 · 2026-10-22
- Google DeepMind researchers reportedly bound by perpetual non-disparagement clauses — zetalyrae · 2026-10-22
- India's UIDAI tells public to stop posting Aadhaar numbers after activist pressure — kingslyj · 2026-10-22
- Ex-cyber-insurance adjuster's playbook for when your cloud provider is breached — mattshumer_ · 2026-10-22
- Dev warns: not running AI vuln-mining on your codebase is malpractice — saranormous · 2026-10-22
- tszzl: AI cyber offense stays dominant as every new model opens fresh attack surfaces — tszzl · 2026-10-22