How the Compromised Version of LiteLLM 1.107.0 Infiltrated Python Environments

The malicious version of LiteLLM 1.107.0 was distributed via the Python Package Index (PyPI) and official Docker images, despite no explicit import of LiteLLM in user code. According to Microsoft, attackers exploited a flaw in the publication workflow using stolen GitHub credentials to redirect builds to a lookalike repository named Berri-AI/litellm (with an extra hyphen).

Three malicious files (cook.pth, cook.py, and sitecustomize.py) were injected into the package before its build. These files, placed in the directory litellm-1.107.0.data/purelib/, are copied into the Python library path during installation. Upon starting the Python interpreter, they execute automatically, regardless of the running application.

Removing the package or its release tag is not enough for full recovery, as installed Python hooks persist in the infected environment.

The Technical Mechanisms of Data Theft and Exfiltration

Microsoft outlines two attack vectors: a credential collector operating via a path extension (on Windows) and a Unix-oriented loader using specific configurations. The collector targets authentication materials stored in developer tools, AI applications, cloud environments, browsers, and infrastructures, as confirmed by observations on Windows and macOS.

An integrated database module in the payload attempts to read records from the tables LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable, while Python’s os and requests modules are used to parse and exfiltrate sensitive files, including SSH keys, AWS credentials, browser passwords, and shell command history. According to Dev.to, a persistent daemon process contacts an attacker-controlled server hourly to execute arbitrary commands.

Persistent risks remain despite the removal of the infected version

PyPI removed version 1.107.0 of LiteLLM on October 21, 2026, and the Docker images labeled latest, main-latest, and main-stable have been marked as compromised. However, Microsoft warns that removing the package or its release tag is not enough for full recovery, as installed Python hooks persist in the environment. Systems using tools like pip install --upgrade or CI/CD pipelines with elevated permissions remain exposed, especially if dependencies are not locked with a specific digest (such as litellm==1.106.2).

Endor Labs highlights that the compromise relies on a malicious line added to the Maturin configuration (data = "cook"), absent from the official version. Infected artifacts include wheels, Docker images, and source distributions, all built from an altered source revision.

What this means here: implications for Beninese and West African businesses and administrations

For businesses and government agencies in Benin and West Africa using AI tools, CI/CD pipelines, or Python environments for development, this attack underscores the importance of systematically verifying third-party dependencies, particularly through tools like pip-audit or container provenance analysis. Organizations should:

• Update immediately to litellm==1.106.2 or an earlier uncompromised version, avoiding the latest or main tags in Docker registries.
• Lock dependency versions in requirements.txt or Dockerfile to prevent uncontrolled automatic updates.
• Strengthen access controls for development accounts and CI/CD workflows, limiting approval permissions and using temporary SSH keys or tokens.
• Monitor unusual activity in Python environments, such as persistent processes or unauthorized outgoing connections to external servers.

Administrations using cloud infrastructure (AWS, for example) or local AI tools must also audit their configurations to detect any lingering traces of this compromise, particularly in credential tables or proxies used by LiteLLM.