[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","rapid-alert","LiteLLM 1.107.0 supply chain attack: poisoned PyPI and Docker images steal cloud and AI credentials","On 21 Oct, LiteLLM 1.107.0 shipped a credential stealer and backdoor through all seven PyPI wheels and Docker images. The packages were live for about three hours and downloaded over 49,000 times. Just starting Python in an affected environment runs the malware. Clean version: 1.106.2.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-cover.png","LiteLLM 1.107.0 rapid alert: Ran LiteLLM 1.107.0 anywhere? Just starting Python leaked your keys.","Marcus Lenngren","2026-10-23T12:58:00.867+00:00","![LiteLLM 1.107.0 rapid alert: Ran LiteLLM 1.107.0 anywhere? Just starting Python leaked your keys.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nOn 21 October 2026, attackers published a malicious LiteLLM version 1.107.0 to PyPI and to Docker Hub and GHCR. LiteLLM is a widely used proxy and SDK for routing requests across LLM providers, with about 92 million monthly PyPI downloads and users including NVIDIA, Netflix, AT&T and Okta.\n\nThe attackers did not touch the application code. They placed three files, cook.pth, cook.py and sitecustomize.py, into the Python library directory. When Python starts, it processes executable .pth lines and then imports sitecustomize, so the payload runs before any application imports LiteLLM. The payload is a credential stealer plus a remote access tool. Running Python or pip to inspect or repair an affected install also triggers it.\n\nThe stealer harvests cloud credentials (AWS, GCP, Azure, Kubernetes, Docker), AI tool keys (Anthropic, OpenAI, GitHub Copilot and more), LiteLLM's stored provider keys, Git, GitHub, npm, PyPI and CI\u002FCD credentials, .env files, SSH, GPG and TLS keys, browser logins and cookies, environment variables and shell history. Stolen data is encrypted with AES-256-CBC under an RSA-4096 key and sent to litellm[.]dev\u002Fhealthcheck. The sitecustomize.py loader checks a GitHub-hosted pointer every hour and runs whatever Python the attacker serves.\n\nPer LiteLLM's post-mortem, the attackers obtained GitHub CLI OAuth tokens for an innocuously named account in its internal, internet-exposed deployment. The tokens were likely leaked into LiteLLM logs by Claude Code. The attackers disabled branch protections, merged a change pointing the releaser to a lookalike repository (Berri-AI\u002Flitellm, one hyphen off the real BerriAI\u002Flitellm), then signed and published the poisoned artifacts.\n\n## Timeline\n\n- 09:48 UTC: commit adds the payload data directory to the build config.\n- 10:51 to 11:06 UTC: malicious container build runs.\n- 11:39:51 UTC: all seven wheels live on PyPI.\n- 11:46 UTC: multiple scanners flag the malware, within minutes of publish.\n- ~13:14 UTC: GHCR floating tags found resolving to the malicious image.\n- 13:23 UTC: PyPI wheels removed.\n- 13:51 UTC: GHCR images made unavailable.\n- 14:20 UTC: Docker Hub tags repointed to clean artifacts.\n\n## Am I affected?\n\nYou are affected if, during the window on 21 October, you:\n\n- Installed litellm 1.107.0 from PyPI (any of the seven wheels, on Windows, Linux or macOS).\n- Pulled ghcr.io\u002Fberriai\u002Flitellm, litellm-database or litellm-non_root, or litellm\u002Flitellm on Docker Hub, by the tags v1.107.0, latest, main-latest or main-stable. Floating tags could have pulled the bad image without you selecting 1.107.0.\n\nLiteLLM says enterprise customers pulling from its private repository were not affected.\n\n## What to do now\n\n1. Stop and isolate any deployment, proxy container or CI runner that ran 1.107.0. Do not start Python or pip in those environments to \"check\" them.\n2. Treat the host as compromised. Isolate it and rebuild from clean backups. Removing the LiteLLM package directory alone can leave the startup files or an active loader behind.\n3. Rotate every secret that touched the environment: AWS, GCP and Azure credentials, Kubernetes and Docker secrets, AI provider keys, Git and GitHub tokens, npm and PyPI tokens, CI\u002FCD credentials, SSH, GPG and TLS keys, and database connection strings.\n4. Pin and redeploy from a known clean version: 1.106.2, the latest release before the attack.\n5. Pin Docker images by digest, not floating tags, after confirming the digest is clean.\n\n## How to hunt\n\n- Search filesystems and images for cook.pth, cook.py and sitecustomize.py in the Python library directory. Inspect images and wheels as data, without executing them.\n- Check outbound connections and logs for litellm[.]dev, in particular requests to \u002Fhealthcheck.\n- Review any Python process that set the environment variable PRIVCOLLECT_ACTIVE=1.\n- For cloud accounts, review logs for unexpected activity. Wiz observed attackers using stolen AWS credentials to query Amazon Bedrock models (LLMjacking) about 4.5 hours after exfiltration.\n- Check for the compromised image index sha256:1bbcb1443bc9… and the related database and non_root digests.\n\n## What does not help\n\n- Deleting the litellm package directory on its own. The .pth and sitecustomize startup hooks or the hourly loader can persist.\n- Reviewing the release tag's pyproject.toml. The malicious data setting was not present in the tag, so a tag-only review would miss it.\n- Starting Python or pip to inspect the install. That re-runs the payload.\n\n## Sources\n\n- [LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials](https:\u002F\u002Fsocket.dev\u002Fblog\u002Flitellm-compromise?utm_medium=feed), SocketDev, 21 Oct\n- [LiteLLM Compromised in Fresh Supply Chain Attack](https:\u002F\u002Fwww.securityweek.com\u002Flitellm-compromised-in-fresh-supply-chain-attack\u002F), SecurityWeek, 23 Oct\n- [LiteLLM release pipeline hacked to distribute info-stealer malware](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Flitellm-release-pipeline-hacked-to-distribute-info-stealer-malware\u002F), BleepingComputer, 22 Oct\n- [LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flitellm-compromised-in-supply-chain.html), The Hacker News, 21 Oct\n- [LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release](https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Flitellm-suspects-github-token-leak-in.html), The Hacker News, 22 Oct\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]