"We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," said Oliver Jensen, director of security at LiteLLM.
What LiteLLM says happened and what it has done
LiteLLM reports that version 1.107.0 of its Python package was published with malicious artifacts after three engineers' GitHub accounts were used to perform the release. The compromised release was distributed through PyPI wheels and Docker images. The Python package has been quarantined on the Python Package Index (PyPI) and the malicious Docker images have been removed.
According to Jensen, the attacker used one user's account to trigger the project-releaser workflow and another to approve it. All tokens involved in the incident have been revoked, and as a temporary mitigation LiteLLM said it removed all but one (unaffected) user from its GitHub organization. The project also updated public registries to remove trusted links to its GitHub organization to prevent further publication of malicious packages. Jensen said the investigation is ongoing and that the team has not yet identified how the OAuth tokens were obtained, so it "cannot yet assert that no further access to these GitHub accounts."
Technical behavior of the malicious release
Multiple security firms — SafeDep, Socket, StepSecurity, and Upwind — analyzed the tampered package and reported two distinct payloads. StepSecurity called the first payload a credential stealer that identifies itself as "privcollect." The second payload is a backdoor that forks a background daemon to poll a "GitHub dead drop" every hour and execute any Python code the attacker serves.
The malicious wheels for litellm-1.107.0 are explicitly listed in the analysis and include macOS, manylinux, musllinux, and Windows builds as well as a source tarball that contained a tampered pyproject.toml. Affected files named in the report include, for example, litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl and litellm-1.107.0.tar.gz (the tarball contained no payload files but had a modified pyproject.toml).
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleHow the malware runs and what it steals
The malicious code is executed automatically by Python before the LiteLLM package is even imported. The attackers used a path file — "cook.pth" — that contains a single line, "import cook." That construct launches the credential collector payload. Analysts noted the same pre-import execution behavior in a previous LiteLLM compromise tied to the TeamPCP supply chain attacks earlier this March.
The credential collector harvests cloud tokens, developer account credentials and private keys, AI tooling credential JSON files, browser data associated with Chromium and Firefox, and environment variables. It also targets LiteLLM deployments to extract a proxy's saved credentials and model configuration. Collected data is packaged into a GZIP-compressed TAR archive and exfiltrated via an HTTP POST to "litellm[.]dev/healthcheck."
Additionally, the malware is designed to read a text file named "domain.txt" in a GitHub repository "github[.]com/letters9813"; if that file contains a domain the malware will run the stealer again and then perform an HTTP GET against "<domain>/codepy" and execute whatever code is returned. At the time of the report, the referenced GitHub repository returned a 404 error.
Immediate mitigation and guidance for users
Security responders advising users of the compromised release recommend revoking and replacing any exposed credentials from a clean environment. The advisory also directs users to pin to LiteLLM version 1.106.2 by digest to avoid the malicious 1.107.0 artifacts. Python and Docker registries have already quarantined and removed the identified malicious artifacts, respectively.
What this means for developers, enterprises, and open-source maintainers
- Developers and security teams: Review any systems where litellm-1.107.0 was installed; revoke and rotate credentials that may have been exposed and pin to 1.106.2 by digest. Check for unexpected HTTP POSTs to "litellm[.]dev/healthcheck" and for the presence of path files such as "cook.pth" in Python site-packages.
- Affected enterprises and procurement leaders: Inventory deployments that use LiteLLM and confirm no Docker or wheel artifacts from 1.107.0 remain in internal registries. Treat any exposed cloud tokens, private keys, or AI-tooling credential files as compromised until replaced.
- Open-source maintainers: Note the reported use of stolen GitHub CLI OAuth tokens to publish the release; preserve and review audit logs, remove unnecessary repository links in public registries, and consider temporary restriction of publishing privileges as LiteLLM did for its organization.
The incident leaves two concrete questions open in the public record: how the GitHub CLI OAuth tokens were acquired, and whether any access beyond the revoked tokens persists. LiteLLM's investigation is ongoing; until it is complete, any environment that accepted litellm-1.107.0 should assume potential compromise and follow the revoke-and-rotate guidance.
