Compromised LiteLLM Release Ran Credential Stealer at Python Startup

A compromised LiteLLM 1.107.0 release reached PyPI and official images on October 21. Microsoft found cook.pth, cook.py and sitecustomize.py in its wheels. Installation placed them in Python’s environment library path, where ordinary interpreter startup could launch a credential collector even when an application never imported LiteLLM. One observed Windows process triggered it while installing an unrelated dependency. Developer workstations, build agents, containers and AI gateways all belong in the inventory.

The collector targeted developer and cloud credentials, browser data, private keys and process environments; a conditional module could reach LiteLLM proxy records. It packed encrypted data for hxxp://www[.]litellm[.]dev/healthcheck. Correlate the destination with Python process ancestry, startup-file hashes and .pc_e_ staging rather than treating package presence alone as completed theft. A separate Unix loader could retrieve additional code; Microsoft found its pointer empty when examined and did not confirm second-stage execution.

Find 1.107.0 across installed packages, caches, mirrors, lock files and image digests. Isolate affected systems and inspect from a known-clean machine, because starting python or pip inside the suspect environment can rerun the hooks. Rebuild from verified artifacts; check that all three startup files are absent from the new library path. Rotate credentials reachable by the affected identity from a clean machine and revoke active sessions. Verify the rebuilt image digest before returning it to service.