LiteLLM 1.107.0 compromised in supply chain attack delivering credential stealer and GitHub-controlled backdoor

Researchers at SafeDep, Socket, StepSecurity, and Upwind reported that LiteLLM version 1.107.0, a popular Python AI gateway, was published with malware through compromised GitHub CLI OAuth tokens belonging to three engineers. A cook.pth file runs a payload whenever the Python interpreter starts, even before LiteLLM is imported. The first stage, calling itself privcollect, harvests cloud tokens, developer credentials, private keys, AI tooling credential files, browser data, environment variables, and the proxy's saved keys and model config, exfiltrating over HTTP to litellm[.]dev/healthcheck. A second payload is a backdoor that fetches and runs further commands. The PyPI package and Docker images were pulled, and users should pin to 1.106.2.

Check

Check whether LiteLLM 1.107.0 was installed from PyPI or Docker, and if so revoke and replace all reachable credentials from a clean machine, then pin to 1.106.2.

Affected

Systems that installed LiteLLM 1.107.0 ran a credential stealer and backdoor on Python startup, exposing cloud tokens, keys, browser data, and the LiteLLM proxy's saved secrets.

Fix

Pin LiteLLM to 1.106.2 by digest, rotate every exposed credential, remove the cook.pth persistence, and block outbound traffic to the litellm.dev healthcheck exfiltration endpoint.