Compromised LiteLLM release stole secrets through Python startup files

LiteLLM’s release pipeline was compromised on October 21, distributing malicious Python wheels and container images, according to BleepingComputer’s October 22 report. The maintainer said version 1.107.0 contained malware that stole credentials and loaded remote execution tools. The affected artifacts included all seven PyPI wheels and several Docker Hub and GHCR tags.

The wheels affected Windows, Linux, and macOS environments. Researchers said malicious Python startup files executed before application code; even running Python or pip to investigate could trigger them. The payload targeted cloud credentials, developer secrets, private keys, browser data, and environment variables, according to the reported analysis. Python’s welcome mat had become an execution path.

The report’s recovery guidance calls for stopping affected deployments, inspecting without launching Python, isolating infected systems, rebuilding from clean backups, and rotating exposed secrets. Removing the package directory alone may leave startup files or a loader behind. It identifies 1.106.2 as the recommended clean recovery release; the maintainer said private enterprise customers were unaffected.