--- title: litellm 1.107.0 Compromised on PyPI: Backdoored Wheels... description: LiteLLM version 1.107.0 was published to PyPI with malware baked into all seven of its compiled wheels. The package installs cook.pth, cook.py, and... canonical: https://daily.dev/posts/litellm-1-107-0-compromised-on-pypi-backdoored-wheels-drop-a-credential-stealer-and-an-hourly-remot-96ccer1x1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader | daily.dev og:description: LiteLLM version 1.107.0 was published to PyPI with malware baked into all seven of its compiled wheels. The package installs cook.pth, cook.py, and... og:url: https://daily.dev/posts/litellm-1-107-0-compromised-on-pypi-backdoored-wheels-drop-a-credential-stealer-and-an-hourly-remot-96ccer1x1 og:image: https://api.daily.dev/og/posts/96cCeR1x1.png og:image:alt: litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 14 min read · 0 upvotes · 0 comments ## Summary LiteLLM version 1.107.0 was published to PyPI with malware baked into all seven of its compiled wheels. The package installs cook.pth, cook.py, and sitecustomize.py, which run automatically on every Python start without any import needed. One payload, called privcollect, steals browser passwords, SSH and GPG keys, cloud credentials, over 20 AI coding tool configs, and LiteLLM proxy database API keys, then encrypts and sends them to the lookalike domain www.litellm.dev. The second payload runs a background daemon that checks a GitHub dead drop hourly for remote code to execute. This is the second LiteLLM PyPI compromise this year, after the 1.82.7/1.82.8 incident in March. The fix is to remove the payload files, kill the daemon, reinstall litellm 1.106.2, and rotate every reachable credential. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the malicious litellm 1.107.0 package execute code without anyone importing it? It abused two CPython startup hooks: a cook.pth file in site-packages whose single line 'import cook' runs automatically via Python's site module, and a sitecustomize.py that site imports right after .pth processing. Both run on every interpreter start, including pip, pytest, or Jupyter, with no explicit import of litellm required. _Anyone auditing Python dependency risks can track supply chain writeups like this one on daily.dev._ ### What data did the litellm PyPI supply chain attack in October 2026 steal? The privcollect stealer in litellm 1.107.0 collected browser passwords and cookies, SSH and GPG keys, cloud credentials (AWS, Azure, GCP), Kubernetes and Docker configs, CI/CD secrets, every running process's environment variables, and configs for over 20 AI coding tools including Claude Code, Cursor, and Copilot. It also dumped the LiteLLM proxy's own stored provider API keys from its database. _Teams rotating secrets after a dependency compromise can follow incident breakdowns like this on daily.dev._ ### How do I check if I installed the compromised litellm 1.107.0 package? Search site-packages directories, including virtual environments, for cook.pth or cook.py, and check for a sitecustomize.py that did not come from the Python distribution. Also look for marker files at /tmp/.pc_once_72129118c59f5636c0bb and /tmp/remote_code_loader.lock. If found, kill the process holding the loader lock, remove the files, reinstall litellm==1.106.2, and rotate all reachable credentials. _Developers checking dependencies for compromise can keep up with IOC disclosures like this via daily.dev._ ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-e5bm44uro) · Schneier on Security · 0 upvotes · 0 comments - [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#litellm](https://daily.dev/tags/litellm) [View this post on daily.dev](https://daily.dev/posts/litellm-1-107-0-compromised-on-pypi-backdoored-wheels-drop-a-credential-stealer-and-an-hourly-remot-96ccer1x1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader","url":"https://daily.dev/posts/litellm-1-107-0-compromised-on-pypi-backdoored-wheels-drop-a-credential-stealer-and-an-hourly-remot-96ccer1x1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/litellm-1-107-0-compromised-on-pypi-backdoored-wheels-drop-a-credential-stealer-and-an-hourly-remot-96ccer1x1"},"datePublished":"2026-10-21T14:04:23.438Z","dateModified":"2026-10-21T18:45:57.358Z","description":"LiteLLM version 1.107.0 was published to PyPI with malware baked into all seven of its compiled wheels. The package installs cook.pth, cook.py, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/31a91b23bd37af914ddc6d89475691b4?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/31a91b23bd37af914ddc6d89475691b4?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/litellm-1-107-0-compromised-on-pypi-backdoored-wheels-drop-a-credential-stealer-and-an-hourly-remot-96ccer1x1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,python,litellm","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/litellm-1-107-0-compromised-on-pypi-backdoored-wheels-drop-a-credential-stealer-and-an-hourly-remot-96ccer1x1#faq","mainEntity":[{"@type":"Question","name":"How did the malicious litellm 1.107.0 package execute code without anyone importing it?","acceptedAnswer":{"@type":"Answer","text":"It abused two CPython startup hooks: a cook.pth file in site-packages whose single line 'import cook' runs automatically via Python's site module, and a sitecustomize.py that site imports right after .pth processing. Both run on every interpreter start, including pip, pytest, or Jupyter, with no explicit import of litellm required. Anyone auditing Python dependency risks can track supply chain writeups like this one on daily.dev."}},{"@type":"Question","name":"What data did the litellm PyPI supply chain attack in October 2026 steal?","acceptedAnswer":{"@type":"Answer","text":"The privcollect stealer in litellm 1.107.0 collected browser passwords and cookies, SSH and GPG keys, cloud credentials (AWS, Azure, GCP), Kubernetes and Docker configs, CI/CD secrets, every running process's environment variables, and configs for over 20 AI coding tools including Claude Code, Cursor, and Copilot. It also dumped the LiteLLM proxy's own stored provider API keys from its database. Teams rotating secrets after a dependency compromise can follow incident breakdowns like this on daily.dev."}},{"@type":"Question","name":"How do I check if I installed the compromised litellm 1.107.0 package?","acceptedAnswer":{"@type":"Answer","text":"Search site-packages directories, including virtual environments, for cook.pth or cook.py, and check for a sitecustomize.py that did not come from the Python distribution. Also look for marker files at /tmp/.pc_once_72129118c59f5636c0bb and /tmp/remote_code_loader.lock. If found, kill the process holding the loader lock, remove the files, reinstall litellm==1.106.2, and rotate all reachable credentials. Developers checking dependencies for compromise can keep up with IOC disclosures like this via daily.dev."}}]} ```