LiteLLM hit by supply chain attack: what you need to know
LiteLLM supply chain compromise: What you need to know
On October 21, 2026, attackers published a malicious version 1.107.0 of the LLM agent library litellm (about 23 million weekly downloads), which was on PyPI and the official Docker image for about two hours before being removed. This version wrote cook.pth, cook.py, and sitecustomize.py into site-packages, triggered whenever any Python process started, even if LiteLLM was never imported; the payload stole cloud platform credentials, SSH keys, LLM provider API keys, sessions of AI coding tools such as Claude, Codex, and Cursor, browser passwords, and LiteLLM proxy database credentials, encrypted them and sent them to the impersonating domain www.litellm[.]dev, and included a second-stage RAT backdoor that downloaded and executed code hourly from a domain read from a fixed GitHub file. It is recommended to manually delete the payload files, roll back to 1.106.2, and rotate all affected credentials.
The article gives the affected versions, the payload persistence mechanism, and cleanup steps, so teams using LiteLLM can use it to check their environments and rotate credentials.