{
  "entry": {
    "kind": "vuln",
    "slug": "litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook",
    "name": "litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook",
    "vendor": "litellm",
    "description": "On 21 October 2026, litellm 1.107.0 was published to PyPI with malware in all seven wheels, live from 11:39 to 13:23 UTC, and the Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable pointed to compromised images from 11:46 UTC until as late as 14:20 UTC. LiteLLM says the attacker took GitHub CLI OAuth tokens for three developers from the logs of an internet-exposed internal deployment, disabled branch protection, pointed the release workflow at the lookalike repository Berri-AI/litellm, and used a second account to pass the production approval gate; the official v1.107.0 source tag is clean. The wheels drop cook.pth, cook.py and sitecustomize.py into site-packages, so every Python start in that environment runs the payload whether or not litellm is imported. StepSecurity names the stealer privcollect: it takes browser passwords and cookies, SSH and GPG keys, cloud, Kubernetes, Docker and package-registry credentials, the environment of every readable process, shell history, upstream provider keys from the LiteLLM proxy database, and the configs and credentials of more than 20 AI coding tools, including Claude Code and Claude Desktop, Cursor, Windsurf, Kiro, Copilot, Cline, Roo, Continue, Aider, Goose, opencode, Gemini CLI OAuth credentials and Codex auth.json. Data is posted to http://www.litellm.dev/healthcheck, and on Linux and macOS a detached loader fetches and executes more Python every hour. LiteLLM's write-up also notes that Claude Code can echo a GitHub CLI token in a response body, which is how such tokens reach proxy logs that record bodies. This is the second LiteLLM PyPI compromise this year.",
    "website": "https://docs.litellm.ai/blog/security-incident-oct-21-2026",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "pypi",
      "packageName": "litellm",
      "command": null
    },
    "configFiles": null,
    "category": "package",
    "updatedAt": "2026-10-21",
    "risk": {
      "score": 90,
      "band": "critical",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "litellm-1-107-0-compromised-on-pypi-and-docker-a-cook-pth-startup-hook",
      "aliases": [
        "ti-150"
      ],
      "title": "LiteLLM 1.107.0 Compromised on PyPI and Docker: A cook.pth Startup Hook Stole Configs From 20+ AI Coding Tools and Loaded Remote Code Every Hour",
      "summary": "On 21 October 2026, litellm 1.107.0 was published to PyPI with malware in all seven wheels, live from 11:39 to 13:23 UTC, and the Docker Hub and GHCR tags v1.107.0, latest, main-latest and main-stable pointed to compromised images from 11:46 UTC until as late as 14:20 UTC. LiteLLM says the attacker took GitHub CLI OAuth tokens for three developers from the logs of an internet-exposed internal deployment, disabled branch protection, pointed the release workflow at the lookalike repository Berri-AI/litellm, and used a second account to pass the production approval gate; the official v1.107.0 source tag is clean. The wheels drop cook.pth, cook.py and sitecustomize.py into site-packages, so every Python start in that environment runs the payload whether or not litellm is imported. StepSecurity names the stealer privcollect: it takes browser passwords and cookies, SSH and GPG keys, cloud, Kubernetes, Docker and package-registry credentials, the environment of every readable process, shell history, upstream provider keys from the LiteLLM proxy database, and the configs and credentials of more than 20 AI coding tools, including Claude Code and Claude Desktop, Cursor, Windsurf, Kiro, Copilot, Cline, Roo, Continue, Aider, Goose, opencode, Gemini CLI OAuth credentials and Codex auth.json. Data is posted to http://www.litellm.dev/healthcheck, and on Linux and macOS a detached loader fetches and executes more Python every hour. LiteLLM's write-up also notes that Claude Code can echo a GitHub CLI token in a response body, which is how such tokens reach proxy logs that record bodies. This is the second LiteLLM PyPI compromise this year.",
      "severity": "critical",
      "cvss": {
        "score": null,
        "vector": null,
        "version": null
      },
      "cwe": [],
      "attackType": [
        "Supply chain compromise",
        "Credential theft",
        "Malware"
      ],
      "componentType": "package",
      "component": {
        "name": "litellm",
        "vendor": null,
        "package": "litellm",
        "ecosystem": "pypi",
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "1.107.0",
          "fixed": null
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-21",
      "modifiedAt": "2026-10-21",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "article",
          "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
        }
      ],
      "mitigation": "Do not run pip in an affected environment first, because any Python start re-runs the payload. From a shell, delete cook.pth, cook.py, sitecustomize.py and their __pycache__ entries from every site-packages directory, kill the Python process holding /tmp/remote_code_loader.lock, then rebuild the virtualenv or image pinned to litellm 1.106.2 (or another explicit pre-incident version) and pull Docker images by digest. If 1.107.0 ran on a host with outbound access, assume exfiltration succeeded even without the /tmp/.pc_once_* marker, and rotate everything the host could reach: instance or task role credentials, every provider key in the LiteLLM database plus master and virtual keys, the DATABASE_URL password, secrets in process environments, GitHub CLI and package-registry tokens, SSH keys, and on a developer machine the credentials of every AI coding tool. Block litellm.dev, check CloudTrail for GetCallerIdentity calls from the instance role around install time, and pin Python dependencies by version and hash.",
      "detectedByAnomity": false
    }
  }
}