<!-- mobian-agent-page publisher="dailydev" canonical="https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas" -->

---
title: LiteLLM supply chain attack hoovers up passwords and secrets
description: Attackers compromised LiteLLM's release pipeline and published a malicious version 1.107.0 through PyPI and Docker registries. It installs an infostealer and a...
canonical: https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas
twitter:card: summary_large_image
twitter:site: @dailydotdev
og:type: website
og:site_name: daily.dev
og:title: LiteLLM supply chain attack hoovers up passwords and secrets | daily.dev
og:description: Attackers compromised LiteLLM's release pipeline and published a malicious version 1.107.0 through PyPI and Docker registries. It installs an infostealer and a...
og:url: https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas
og:image: https://api.daily.dev/og/posts/0s4JBuwas.png
og:image:alt: LiteLLM supply chain attack hoovers up passwords and secrets
og:image:width: 1200
og:image:height: 630
og:locale: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# LiteLLM supply chain attack hoovers up passwords and secrets

**[The Register](https://daily.dev/sources/theregister)** · 4 min read · 0 upvotes · 0 comments

## Summary

Attackers compromised LiteLLM's release pipeline and published a malicious version 1.107.0 through PyPI and Docker registries. It installs an infostealer and a remote access trojan that run automatically whenever Python starts. The malware steals browser credentials, AWS and GCP keys, Azure tokens, SSH and GPG keys, and API keys for OpenAI and Anthropic, then exfiltrates them encrypted with AES-256-CBC and RSA-4096 to an attacker domain. PyPI quarantined the package within hours; the safe version is v1.106.2. LiteLLM gets about 23 million weekly downloads, and an earlier March compromise potentially exposed more than 2,500 organizations and 434,000 CI/CD pipelines.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548>

## Questions this post answers

### Is LiteLLM version 1.107.0 safe to use?

No, version 1.107.0 is compromised with malware. Attackers injected three malicious files, cook.pth, cook.py, and sitecustomize.py, into the release pipeline via a hyphenated lookalike repo, Berri-AI/litellm. The files install an infostealer and a remote access trojan that run automatically whenever Python is invoked. The most recent safe version is v1.106.2.

_Teams tracking LiteLLM updates can follow dependency security advisories like this on daily.dev._

### What data does the LiteLLM 1.107.0 malware steal?

The infostealer harvests data across 16 modules, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, AWS credentials and EC2/ECS instance metadata, Google Cloud service account keys, Azure CLI tokens, SSH and GPG keys, shell history, and API keys for OpenAI, Anthropic, and Cohere. Stolen data is encrypted with AES-256-CBC and an RSA-4096 wrapped key before being sent to an attacker domain.

_Developers auditing dependency breaches can track incident details like this on daily.dev._

### How do I check if I was compromised by the LiteLLM supply chain attack?

Check for the files /tmp/.pc_once_* and /tmp/remote_code_loader.lock on any machine that ran LiteLLM 1.107.0 via PyPI or the Docker image litellm/litellm:1.107.0 (including latest, main-latest, or main-stable tags). Their presence means the exfiltration already fired or the command-and-control daemon ran or is still running, per Aikido Security malware hunter Ilyas Makari.

_Security teams running incident checks can keep up with fast-moving advisories like this on daily.dev._

## Similar posts on daily.dev

- [What the LiteLLM Breach Teaches Us About Securing LLM Gateways](https://daily.dev/posts/what-the-litellm-breach-teaches-us-about-securing-llm-gateways-ysbbrmwzu) · Medium · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#docker](https://daily.dev/tags/docker), [#litellm](https://daily.dev/tags/litellm)

[View this post on daily.dev](https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas)

```json
{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]}
{"@context":"https://schema.org","@type":"TechArticle","headline":"LiteLLM supply chain attack hoovers up passwords and secrets","url":"https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas"},"datePublished":"2026-10-21T18:25:19.840Z","dateModified":"2026-10-21T18:45:58.878Z","description":"Attackers compromised LiteLLM's release pipeline and published a malicious version 1.107.0 through PyPI and Docker registries. It installs an infostealer and a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa13d86c7b3beba45800da97c7752250?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa13d86c7b3beba45800da97c7752250?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cyber,python,docker,litellm","timeRequired":"PT4M"}
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"LiteLLM supply chain attack hoovers up passwords and secrets"}]}
{"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets-0s4jbuwas#faq","mainEntity":[{"@type":"Question","name":"Is LiteLLM version 1.107.0 safe to use?","acceptedAnswer":{"@type":"Answer","text":"No, version 1.107.0 is compromised with malware. Attackers injected three malicious files, cook.pth, cook.py, and sitecustomize.py, into the release pipeline via a hyphenated lookalike repo, Berri-AI/litellm. The files install an infostealer and a remote access trojan that run automatically whenever Python is invoked. The most recent safe version is v1.106.2. Teams tracking LiteLLM updates can follow dependency security advisories like this on daily.dev."}},{"@type":"Question","name":"What data does the LiteLLM 1.107.0 malware steal?","acceptedAnswer":{"@type":"Answer","text":"The infostealer harvests data across 16 modules, including browser credentials and cookies from Chrome, Firefox, Edge, and Safari, AWS credentials and EC2/ECS instance metadata, Google Cloud service account keys, Azure CLI tokens, SSH and GPG keys, shell history, and API keys for OpenAI, Anthropic, and Cohere. Stolen data is encrypted with AES-256-CBC and an RSA-4096 wrapped key before being sent to an attacker domain. Developers auditing dependency breaches can track incident details like this on daily.dev."}},{"@type":"Question","name":"How do I check if I was compromised by the LiteLLM supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Check for the files /tmp/.pc_once_* and /tmp/remote_code_loader.lock on any machine that ran LiteLLM 1.107.0 via PyPI or the Docker image litellm/litellm:1.107.0 (including latest, main-latest, or main-stable tags). Their presence means the exfiltration already fired or the command-and-control daemon ran or is still running, per Aikido Security malware hunter Ilyas Makari. Security teams running incident checks can keep up with fast-moving advisories like this on daily.dev."}}]}
```