{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "litellm"
      },
      "versions": [
        "1.82.7",
        "1.82.8",
        "1.107.0"
      ]
    }
  ],
  "aliases": [
    "PYSEC-2026-2"
  ],
  "credits": [
    {
      "contact": [
        "https://github.com/ossf/package-analysis",
        "https://openssf.slack.com/channels/package_analysis"
      ],
      "name": "OpenSSF: Package Analysis",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/tboulet"
      ],
      "name": "Timothe Boulet",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "litellm.cloud"
      ],
      "files": [
        {
          "digests": {
            "sha256": "7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb"
          },
          "note": "Runs `import cook` at every Python interpreter start",
          "paths": [
            "litellm-1.107.0.data/purelib/cook.pth"
          ],
          "source": "PACKAGE_ARCHIVE"
        },
        {
          "digests": {
            "sha256": "9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25"
          },
          "note": "zlib+base64 encoded credential stealer (privcollect)",
          "paths": [
            "litellm-1.107.0.data/purelib/cook.py"
          ],
          "source": "PACKAGE_ARCHIVE"
        },
        {
          "digests": {
            "sha256": "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa"
          },
          "note": "Hourly remote code loader, plus a copy of the encoded stealer",
          "paths": [
            "litellm-1.107.0.data/purelib/sitecustomize.py"
          ],
          "source": "PACKAGE_ARCHIVE"
        },
        {
          "note": "Marker written by the stealer after its first run",
          "paths": [
            "/tmp/.pc_once_72129118c59f5636c0bb"
          ],
          "source": "DROPPED"
        }
      ],
      "urls": [
        "https://models.litellm.cloud/"
      ]
    },
    "malicious-packages-origins": [
      {
        "import_time": "2026-03-24T22:11:35.145201Z",
        "modified_time": "2026-03-24T22:11:32Z",
        "sha256": "6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe",
        "source": "google-open-source-security",
        "versions": [
          "1.82.7",
          "1.82.8"
        ]
      },
      {
        "import_time": "2026-03-26T09:50:43.996758996Z",
        "modified_time": "2026-03-24T11:15:14Z",
        "sha256": "c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c",
        "source": "ossf-package-analysis",
        "versions": [
          "1.82.8"
        ]
      }
    ]
  },
  "details": "litellm 1.107.0, uploaded to PyPI on 2026-10-21 between 11:39 and 11:40 UTC, contains a credential stealer and a remote code execution backdoor that are not in the upstream source (the v1.107.0 git tag of BerriAI/litellm does not contain them): they were injected at build or upload time. Every wheel ships three extra files under litellm-1.107.0.data/purelib/, which pip installs at the site-packages root, so the payload is triggered at every Python interpreter start, without importing litellm.\n\n- cook.pth contains `import cook`.\n- cook.py runs `exec(zlib.decompress(base64.b64decode(...)))`, an info stealer (self-named \"privcollect\") that collects browser passwords and history, SSH keys, shell history, AWS/GCP/Azure credentials and cloud instance metadata (169.254.169.254, 169.254.170.2), Kubernetes, Docker, Vault and CI secrets, AI developer tool configurations (~/.cursor, ~/.claude, ~/.kiro, Windsurf), GPG and TLS private keys, .npmrc, .pypirc, .git-credentials and environment variables, encrypts them with an embedded RSA-4096 key and POSTs them to http://www.litellm.dev/healthcheck. It leaves the marker /tmp/.pc_once_72129118c59f5636c0bb.\n- sitecustomize.py daemonizes at interpreter start and, every hour, fetches a domain list from https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, then downloads and executes code from http://\u003cdomain\u003e/codepy (remote shell / dropper).\n\nThe same mechanism (a .pth file run at interpreter start) was used in litellm 1.82.7 and 1.82.8 (MAL-2026-2144). Releases 1.106.2 and 1.107.0rc1/rc2 are not affected. Any environment where 1.107.0 was installed should be treated as compromised and its credentials rotated.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: google-open-source-security (6a89401cbf53902e8374fbf3b424a77bb5e5f8c437176232eab7c3237d10ecbe)\nLiteLLM was compromised through trivy security scan in a GitHub workflow.\nAttackers uploaded malicious versions of LiteLLM to PyPI. The malicious\ncode would exfiltrate sensitive secrets to an attcker controlled domain.\n\n## Source: ossf-package-analysis (c1d5a2e721c5f8b33b0530ddf98150cadf034a8cd16483e143fc2925b2cfa70c)\nThe OpenSSF Package Analysis project identified \u0027litellm\u0027 @ 1.82.8 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n",
  "id": "MAL-2026-2144",
  "modified": "2026-10-21T21:47:44.202885129Z",
  "published": "2026-03-24T11:15:14Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://github.com/BerriAI/litellm/issues/24518"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/BerriAI/litellm/issues/24512"
    },
    {
      "type": "DISCUSSION",
      "url": "https://news.ycombinator.com/item?id=47501729"
    },
    {
      "type": "ARTICLE",
      "url": "https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign"
    },
    {
      "type": "ARTICLE",
      "url": "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/BerriAI/litellm/issues/47826"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/litellm/1.107.0/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in litellm (PyPI)"
}