1-minute read
What a defender needs to know
StepSecurity found credential-stealing code and an hourly remote-code loader in all seven LiteLLM 1.107.0 PyPI wheels and in official Docker images published October 21. The published source distribution had a tampered build setting but lacked the payload files; the clean Git tag was a poor stand-in for the distributed wheel. Python starts the cook.pth import and sitecustomize.py hook before an application imports LiteLLM. On Windows, the stealer runs but the detached daemon loader fails. StepSecurity found the dead-drop file empty when the release shipped and says the /codepy stage was never armed while that repository existed. The stealer sought cloud and AI-tool credentials, readable process environments and LiteLLM proxy-stored provider keys.
Check lockfiles and install history for 1.107.0; compare running proxy image digests and pull times with v1.107.0 and the affected latest, main-latest and main-stable tags. Look for cook.pth, cook.py and unexpected sitecustomize.py in site-packages, traffic to www[.]litellm[.]dev, and a process holding /tmp/remote_code_loader.lock. Collect evidence without launching the affected Python interpreter, which can rerun the startup hooks.
Isolate affected hosts, replace the environment with verified clean litellm==1.106.2 or a pinned v1.106.2 image digest, and clear cached 1.107.0 artifacts. Rotate credentials reachable from that host, including proxy database keys and provider API keys. Verify the replacement version and the absence of the three startup files; review historical egress because a clean current host cannot undo an earlier credential upload.