Embedded Malicious Code Affecting litellm package, versions [1.107.0][1.82.7][1.82.8]
Threat Intelligence
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PYTHON-LITELLM-21373824
- published21 Oct 2026
- disclosed20 Oct 2026
- creditUnknown
Introduced: 20 Oct 2026
New Malicious CVE NOT AVAILABLE CWE-506 (opens in a new tab)How to fix?
Avoid using all malicious instances of the litellm package.
Overview
litellm is a Library to easily interface with LLM API providers
Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer and a remote code loader. A malicious actor hijacked the PyPI release process to publish tampered wheel files for version 1.107.0 of the litellm package. The payload is delivered via injected startup scripts (cook.pth, cook.py, and sitecustomize.py) that execute automatically upon Python initialization.
RAT Behavior
The payload leverages Python startup mechanisms to run silently before normal application code. cook.py deploys privcollect, a credential stealer designed to harvest SSH/GPG keys, browser data, cloud provider secrets, and the LiteLLM proxy databases (LiteLLM_CredentialsTable). The stolen data is encrypted and exfiltrated to a look-alike domain (www.litellm.dev). Additionally, sitecustomize.py spawns a detached hourly process that polls a dead-drop repository to fetch and execute arbitrary remote Python code.
Notes:
The malicious payload triggers automatically when the Python interpreter initializes in the affected environment, even if the application never explicitly imports litellm.
The compromise affects macOS, Linux, and Windows environments, though the sitecustomize.py daemon fails silently on Windows (while the credential stealer remains active).
Complete remediation requires securely rebuilding the compromised environments from verified artifacts and rotating all accessible system, cloud, and LiteLLM proxy credentials.