Malicious LiteLLM update steals cloud credentials and installs a remote access trojan

On Wednesday, threat actors compromised the LiteLLM open-source AI gateway by uploading a malicious 1.107.0 release to PyPI and Docker registries. The package includes three hidden files—cook.pth, cook.py and sitecustomize.py—that automatically execute on Python startup, stealing credentials from browsers, cloud providers, AI services and SSH keys, then encrypting the data with AES-256-one outlet and an RSA-4096 key before exfiltrating it to a attacker-controlled domain.

PyPI quarantined the package within hours and Docker Hub and GHCR removed the corresponding image. Security researchers from Aikido Security, Google’s Wiz and Socket have published detailed hunting and mitigation steps, recommending users revert to version 1.106.2 and check for temporary files indicating infection. The breach could expose millions of API keys and cloud identities, given LiteLLM’s 23 million weekly downloads. BerriAI, the maintainer of LiteLLM, has not responded to inquiries.