AI tool LiteLLM found to have embedded password-stealing malicious program; installation alone may affect other Python programs
A malicious program that steals passwords was found embedded in the AI tool 'LiteLLM,' and simply installing it could affect other Python programs as well.
Version 1.107.0 of the open-source AI tool LiteLLM, published to PyPI on 21 October 2026, was implanted with an infostealer and backdoor and was taken down about two hours later. An investigation by the security company SafeDep found that all 7 distribution packages for Windows, macOS and Linux contained malicious files, while the source code in the official GitHub repository did not. The malicious program executes via a .pth file that Python automatically loads at startup; it is triggered whenever Python is started in the same environment, without any need to use LiteLLM, and steals passwords and browsing history saved in browsers, SSH private keys, cloud service credentials, and credentials for AI development tools such as Claude Code, Cursor and GitHub Copilot, as well as API keys managed by LiteLLM, encrypts them and sends them to an external server, www.litellm.dev; another file also contains a backdoor that fetches a target server from GitHub every hour and downloads and executes a program prepared by the attacker.
The malicious code runs as soon as Python starts and steals credentials for AI development tools such as Claude Code; developers who installed this version can use this to check their environments.