GoKawiilMalicious LiteLLM 1.107.0 package on PyPI bundled stealer and backdoor
A LiteLLM release published to PyPI as version 1.107.0 contained three hidden files that installed a credential-stealing script and a persistent backdoor on any machine that ran pip install, regardless of whether litellm was ever imported. The malicious code harvested SSH keys, cloud and CI/CD credentials, browser passwords and LLM API keys, sent them to an external domain, and set up an hourly process that fetched and executed remote code. PyPI has removed the release, and the official GitHub source and other recent versions were confirmed clean.
GoKawiil's interpretation of the reporting above, not reported fact.
The injection occurred only in the build configuration of the source distribution used to produce the wheels, meaning a review of the public GitHub repository would not have revealed the tampering, which raises questions about how the malicious release was published to PyPI in the first place. Because the backdoor activated on any Python process start, even unrelated environments sharing a Python installation could have been compromised, giving attackers broad credential access across developer machines and CI systems.
- LiteLLM 1.107.0 on PyPI silently installed a credential stealer and remote-code-execution backdoor via hidden files in site-packages.
- The malicious payload was inserted through an extra line in the sdist's pyproject.toml, not present in the public GitHub repository.
- PyPI has pulled the release; versions 1.106.2, 1.107.0rc1, 1.107.0rc2, and the pinned companion packages remain clean.
Source: safedep.io, 2026-10-21
Published there as: “Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.