<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe" -->

---
title: LiteLLM compromised: infostealer and RAT in PyPI 1.107.0
description: LiteLLM version 1.107.0 was compromised on PyPI with an infostealer and a remote access trojan hidden in its compiled wheels. Seven wheel files across all...
canonical: https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: LiteLLM compromised: infostealer and RAT in PyPI 1.107.0 | daily.dev
og:description: LiteLLM version 1.107.0 was compromised on PyPI with an infostealer and a remote access trojan hidden in its compiled wheels. Seven wheel files across all...
og:url: https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe
og:image: https://api.daily.dev/og/posts/jYXuMNXpe.png
og:image:alt: LiteLLM compromised: infostealer and RAT in PyPI 1.107.0
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# LiteLLM compromised: infostealer and RAT in PyPI 1.107.0

**[Aikido Security](https://daily.dev/sources/aikido-security)** · 5 min read · 0 upvotes · 0 comments

## Summary

LiteLLM version 1.107.0 was compromised on PyPI with an infostealer and a remote access trojan hidden in its compiled wheels. Seven wheel files across all supported operating systems were affected, while the GitHub source repo and the source tarball stayed clean. Python startup runs an infostealer that grabs SSH keys, cloud credentials, browser passwords, CI/CD secrets, and credentials for tools like Claude Code and Cursor, encrypting everything with a hardcoded RSA-4096 key before sending it to an attacker-controlled domain. A second file, sitecustomize.py, runs a background daemon that polls for new commands every hour, giving the attacker ongoing arbitrary code execution. Anyone who ran pip install litellm==1.107.0 should assume credentials are compromised and check for /tmp/.pc_once_* and /tmp/remote_code_loader.lock.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.aikido.dev/blog/litellm-compromised-infostealer-rat>

## Questions this post answers

### How do I check if my machine is compromised by the LiteLLM 1.107.0 PyPI supply chain attack?

Check for two sentinel files: /tmp/.pc_once_* means the infostealer already exfiltrated your credentials, and /tmp/remote_code_loader.lock means the remote access trojan daemon ran or is still running. These only appear if you installed litellm==1.107.0 from a compiled wheel on any operating system, since the GitHub source and PyPI source tarball were not affected.

_Anyone auditing dependencies after a supply chain scare can track incidents like this through daily.dev._

### What credentials does the LiteLLM 1.107.0 malware steal?

It steals SSH private keys, AWS/Azure/GCP cloud credentials and instance metadata, Chromium and Firefox saved passwords, Docker and Kubernetes secrets, CI/CD tokens from GitLab, Jenkins and Vault, and credentials for AI coding tools including Claude Code, Cursor, GitHub Copilot and Codex CLI. It also dumps environment variables from every running process on Linux and the LiteLLM database's stored provider API keys.

_Developers rotating secrets after a breach like this often track remediation guidance on daily.dev._

### How did the attacker inject malware into LiteLLM's PyPI wheels without modifying the GitHub source code?

The attacker exploited a maturin build directive, data = "cook" in pyproject.toml, which bundles an arbitrary local directory into the compiled wheel's data section during the build. The cook/ directory was created only in the compromised build environment, so it never appeared in version control, while three malicious files (cook.pth, cook.py, sitecustomize.py) were silently injected into site-packages on install.

_Teams hardening their own build pipelines against this kind of attack follow writeups like this on daily.dev._

## Similar posts on daily.dev

- [Schneier on Security](https://daily.dev/posts/schneier-on-security-e5bm44uro) · Schneier on Security · 0 upvotes · 0 comments

---

Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#malware](https://daily.dev/tags/malware), [#litellm](https://daily.dev/tags/litellm)

[View this post on daily.dev](https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"LiteLLM compromised: infostealer and RAT in PyPI 1.107.0","url":"https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe"},"datePublished":"2026-10-21T13:25:52.020Z","dateModified":"2026-10-21T18:45:57.358Z","description":"LiteLLM version 1.107.0 was compromised on PyPI with an infostealer and a remote access trojan hidden in its compiled wheels. Seven wheel files across all...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9275254677c2f6cfbbc7529924c5a2bc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9275254677c2f6cfbbc7529924c5a2bc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Aikido Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Aikido Security","logo":"https://media.daily.dev/image/upload/s--vJDqDYv_--/f_auto,q_auto/v1774959928/logos/aikido-security?_a=BAMAMiWQ0","url":"https://daily.dev/sources/aikido-security"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,malware,litellm","timeRequired":"PT5M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Aikido Security","item":"https://daily.dev/sources/aikido-security"},{"@type":"ListItem","position":3,"name":"LiteLLM compromised: infostealer and RAT in PyPI 1.107.0"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/litellm-compromised-infostealer-and-rat-in-pypi-1-107-0-jyxumnxpe#faq","mainEntity":[{"@type":"Question","name":"How do I check if my machine is compromised by the LiteLLM 1.107.0 PyPI supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Check for two sentinel files: /tmp/.pc_once_* means the infostealer already exfiltrated your credentials, and /tmp/remote_code_loader.lock means the remote access trojan daemon ran or is still running. These only appear if you installed litellm==1.107.0 from a compiled wheel on any operating system, since the GitHub source and PyPI source tarball were not affected. Anyone auditing dependencies after a supply chain scare can track incidents like this through daily.dev."}},{"@type":"Question","name":"What credentials does the LiteLLM 1.107.0 malware steal?","acceptedAnswer":{"@type":"Answer","text":"It steals SSH private keys, AWS/Azure/GCP cloud credentials and instance metadata, Chromium and Firefox saved passwords, Docker and Kubernetes secrets, CI/CD tokens from GitLab, Jenkins and Vault, and credentials for AI coding tools including Claude Code, Cursor, GitHub Copilot and Codex CLI. It also dumps environment variables from every running process on Linux and the LiteLLM database's stored provider API keys. Developers rotating secrets after a breach like this often track remediation guidance on daily.dev."}},{"@type":"Question","name":"How did the attacker inject malware into LiteLLM's PyPI wheels without modifying the GitHub source code?","acceptedAnswer":{"@type":"Answer","text":"The attacker exploited a maturin build directive, data = \"cook\" in pyproject.toml, which bundles an arbitrary local directory into the compiled wheel's data section during the build. The cook/ directory was created only in the compromised build environment, so it never appeared in version control, while three malicious files (cook.pth, cook.py, sitecustomize.py) were silently injected into site-packages on install. Teams hardening their own build pipelines against this kind of attack follow writeups like this on daily.dev."}}]}
```