On October 21, 2026, the LiteLLM project — the widely used LLM proxy abstraction layer maintained by BerriAI — shipped version 1.107.0 to PyPI with two payloads hidden inside: a credential stealer and a persistent remote code execution backdoor. All seven platform wheels (Linux, macOS, Windows) contained them. The upstream GitHub source was clean. The implant activated on every Python process on the host, whether or not it ever imported litellm. The attack was surgically constructed. Three files — cook.pth, cook.py, and sitecustomize.py — were placed in site-packages via a single extra line in pyproject.toml's maturin build config: data = "cook". Python's .pth file mechanism and its automatic sitecustomize import meant both payloads executed at interpreter startup — in the application, in pip, in IDE language servers, in CI jobs. No explicit import of litellm required. The stealer, wrapped in one layer of exec(zlib.decompress(base64.b64decode(...))), harvested SSH keys, cloud credentials (AWS, Azure, GCP, Kubernetes), CI/CD secrets (GitLab, Jenkins, Vault, Terraform), browser passwords, GPG and TLS private keys, shell history, and — critically for LiteLLM deployments — the LLM provider API keys stored in the proxy's database tables. The exfiltration was encrypted (AES-256-CBC with RSA-OAEP key wrapping) and sent to www.litellm[.]dev/healthcheck with a hardcoded bearer token. The backdoor in sitecustomize.py forked a daemon that every hour read a command-and-control domain from a GitHub file (letters9813/pythonclient-test), re-ran the stealer without the once-per-host guard, and executed arbitrary code fetched from that server. By 13:40 UTC the GitHub account was deleted, but any host that ran the daemon before deletion could have received second-stage payloads that SafeDep could not recover. The forensic trail is what makes this attack notable. SafeDep's analysis shows the malicious wheels were built by BerriAI's own private release pipeline — maturin 1.9.4 matching legitimate releases, correct RECORD entries, platform-appropriate line endings (CRLF on Windows, LF on Linux), and zip timestamps showing sequential native builds across macOS, Linux, and Windows within 17 minutes. No public GitHub Actions run built or published the release. The sdist matched a real main-branch commit (a8113b0) plus five edited files and the cook/ folder. SafeDep assesses with moderate-to-high confidence that the attacker compromised a maintainer credential, bot token, or the pipeline's build reference — not that a stolen PyPI token was used from external machines. The dependency-pinning was clever camouflage. The edited pyproject.toml set the version back to 1.107.0 and pinned companion packages to the same values as rc2, so a dependency diff against the release candidates showed nothing unusual. The legitimate 1.106.2 release, uploaded just 55 minutes before the malicious one, had the same Cargo.toml readme edits, further blending the signal. PyPI had no provenance attestations for 1.107.0, 1.106.2, or rc2 — a gap that made post-hoc verification impossible without blob-hash comparison against git trees. The scope of targeted credentials reveals the attacker's understanding of the LiteLLM ecosystem. The stealer's module list reads like a census of modern AI development infrastructure: Claude Code, Cursor, Windsurf, Copilot, Gemini CLI, Codex, Aider, Goose, Hugging Face tokens, and the MCP configuration files for VS Code and Zed. It also hit AWS instance metadata (IMDSv2 then v1 fallback), Kubernetes service account tokens, and Docker configs. For organizations running LiteLLM as a proxy — its primary use case — the database dump of LiteLLMCredentialsTable and LiteLLMProxyModelTable meant every LLM provider key routed through the proxy was exfiltrated in a single pass. Versions 1.106.2, 1.107.0rc1, and 1.107.0rc2 are confirmed clean. The companion packages litellm-proxy-extras 0.4.110 and litellm-enterprise 0.1.78 are also clean. Any environment that installed litellm==1.107.0 between 11:40 and approximately 13:40 UTC on October 21 should be treated as fully compromised: all credentials on the host rotated, all secrets in the LiteLLM proxy database rotated, and forensic analysis conducted for second-stage payloads.
