Skip to content
Open-Source Registry

Incidents / pypi/litellm

pypi/litellm 1.107.0

bitbison: flagged, behavior flagged, dependencies flagged, posture not checked, pipeline clean, 1 of 1 jobs captured RiskcriticalVulnsnone
processes
548
operations
118K
packages
527
compiler runs
2
connections
6
build time
2m 26s
capture
1.7 MB
records
217K
bytes / record
7.6

Python SDK and proxy server for calling LLM provider APIs.

Build behaviourcompiled and nothing more

MIT · published 2026-10-21 · source
Reviewed by Bitbison: maliciousLiteLLM's hijacked release pipeline shipped a credential stealer in every wheel.

Graph

credential-sweep · critical
2

Checks

11 of 17 clear · 4 not checked Credential stores read Code installed to run at every start
Build behavior✓✓▲✓✓✓✓✓✓
Supply chain○○○✓✓▲○
Pipeline✓

Detections

2
  • Code this build ran read 17 credential stores it does not own, then connected to www.litellm.dev
    python3.14 › 169.254.169.254:80, www.litellm.dev:80, sts.us-east-1.amazonaws.com:443, raw.githubusercontent.com:443, files.pythonhosted.org:8080
    critical
  • litellm 1.107.0 installs sitecustomize, which Python runs at every start
    litellm 1.107.0
    high

Detection

criticalwitnessed

Code this build ran read 17 credential stores it does not own, then connected to www.litellm.dev

Many credential stores read by code that does not own them

Subject
python3.14
Destination
169.254.169.254:80, www.litellm.dev:80, sts.us-east-1.amazonaws.com:443, raw.githubusercontent.com:443, files.pythonhosted.org:8080
Jobs
build-import
Rule
credential-sweep

Evidence

  1. Credential store read by code that does not own itcause

    Read /home/runner/.netrc (git)

    source /home/runner/.netrc

    by /tmp/build-env-sf927ax2/bin/python /home/runner/work/litellm/litellm/.venv/lib/python3.14/site-packages/pip/__pip-runner__.py --python /tmp/build-env-sf927ax2/b…

  2. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa.pub (scp)

    source /home/runner/.ssh/id_rsa.pub

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  3. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519 (scp)

    source /home/runner/.ssh/id_ed25519

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  4. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_rsa (scp)

    source /home/runner/.ssh/id_rsa

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  5. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/id_ed25519.pub (scp)

    source /home/runner/.ssh/id_ed25519.pub

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  6. Credential store read by code that does not own itcause

    Read /home/runner/.ssh/config (scp)

    source /home/runner/.ssh/config

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  7. Credential store read by code that does not own itcause

    Read /home/runner/.aws/credentials (aws)

    source /home/runner/.aws/credentials

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  8. Credential store read by code that does not own itcause

    Read /home/runner/.aws/config (aws)

    source /home/runner/.aws/config

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  9. Credential store read by code that does not own itcause

    Read /home/runner/.docker/config.json (ko)

    source /home/runner/.docker/config.json

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  10. Credential store read by code that does not own itcause

    Read /home/runner/.config/gh/hosts.yml (gh)

    source /home/runner/.config/gh/hosts.yml

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  11. Credential store read by code that does not own itcause

    Read /home/runner/.git-credentials (git)

    source /home/runner/.git-credentials

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  12. Credential store read by code that does not own itcause

    Read /home/runner/.npmrc (npm)

    source /home/runner/.npmrc

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  13. Credential store read by code that does not own itcause

    Read /home/runner/.cargo/credentials.toml (cargo)

    source /home/runner/.cargo/credentials.toml

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  14. Credential store read by code that does not own itcause

    Read the project's own credentials (project)

    source /home/runner/work/litellm/litellm/.env

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  15. Credential store read by code that does not own itcause

    Read /home/runner/.vault-token (vault)

    source /home/runner/.vault-token

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  16. Credential store read by code that does not own itcause

    Read /home/runner/.cache/huggingface/token (huggingface-cli)

    source /home/runner/.cache/huggingface/token

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  17. Credential store read by code that does not own itcause

    Read the instance metadata service (169.254.169.254) (instance-metadata)

    source 169.254.169.254:80

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  18. Connected after reading a credential storecause

    python3.14 connected to www.litellm.dev:80 after the reads

    target www.litellm.dev:80

    by .venv/bin/python /home/runner/work/_temp/imports.py litellm

  19. Connected after reading a credential storecause

    python3.14 connected to sts.us-east-1.amazonaws.com:443 after the reads

    target sts.us-east-1.amazonaws.com:443

    by .venv/bin/python -m pip download --no-deps --only-binary :all: --dest published litellm==1.107.0

  20. Connected after reading a credential storecause

    python3.14 connected to raw.githubusercontent.com:443 after the reads

    target raw.githubusercontent.com:443

    by /home/runner/work/litellm/litellm/.venv/bin/python -c import importlib, pkgutil, sys m = importlib.import_module(sys.argv[1]) count = failed = 0 for info in pk…

  21. Connected after reading a credential storecause

    python3.14 connected to files.pythonhosted.org:8080 after the reads

    target files.pythonhosted.org:8080

    by /tmp/build-env-sf927ax2/bin/python /home/runner/work/litellm/litellm/.venv/lib/python3.14/site-packages/pip/__pip-runner__.py --python /tmp/build-env-sf927ax2/b…

  22. Why it matterscontext

    A program reads its own credentials. This build read many credential stores it does not own, of several kinds, which is how a credential stealer collects what it sends out.

What came before it

Loading the graph

Processes

build-import

python

Ran
.venv/bin/python /home/runner/work/_temp/imports.py litellm
Invoked by
.venv/bin/python /home/runner/work/_temp/imports.py litellm

Remediation

Find the code that read these stores and why: a package's install, build or import step has no reason to read credentials it does not own. Treat every credential these stores hold as exposed, and rotate them unless the reads are explained.

Detection

highwitnessed

litellm 1.107.0 installs sitecustomize, which Python runs at every start

Package installs code that runs at every start

Subject
litellm 1.107.0
Jobs
build-import
Rule
startup-hook

Evidence

  1. Installs a module run at every startcause

    litellm 1.107.0 installs sitecustomize at the root of /home/runner/work/litellm/litellm/.venv/lib/python3.14/site-packages. Every Python started in that environment runs it before its own program.

    subject litellm 1.107.0

Remediation

Find out why the package installs code that runs at every Python start. Unless that is its purpose, pin the previous release, rebuild the environment and rotate the credentials the jobs that used it could reach.

Network

6 peers
  • files.pythonhosted.org:8080 pypi/litellm's own build code · python3.14 unjudged
  • raw.githubusercontent.com:443 pypi/litellm's own build code · litellm; python3.14 unjudged
  • sts.us-east-1.amazonaws.com:443 pypi/litellm's own build code · python3.14 unjudged
  • www.litellm.dev:80 pypi/litellm's own build code · python3.14 unjudged
  • static.crates.io:443 the package manager · cargo (litellm-rust) via crates.io · 33,274 files ecosystem
  • 169.254.169.254:80 pypi/litellm's own build code · python3.14 unjudged
Dependencies617Build behaviour
adler22.0.1
ahash0.8.12build script, not run
aho-corasick1.1.5
alloca0.4.0build script, not run
allocator-api20.2.21
android_system_properties0.1.6
anes0.1.6
anstyle1.0.14
anyhow1.0.104build script, not run
arc-swap1.9.2
arcstr1.2.0
asn1-rs0.7.2
asn1-rs-derive0.6.0proc macro
asn1-rs-impl0.2.0proc macro
assert-json-diff2.0.2
astral-tokio-tar0.6.4
async-compression0.4.46
async-lock3.4.2
async-stream0.3.6
async-stream-impl0.3.6proc macro
async-trait0.1.91proc macro
atoi2.0.0
atomic-waker1.1.2
autocfg1.5.1
aws-config1.9.0
aws-credential-types1.3.0
aws-lc-rs1.17.3build script, not run
aws-lc-sys0.43.0build script, not runprebuilt objects
aws-runtime1.9.4
aws-sdk-kms1.120.0
aws-sdk-secretsmanager1.117.0
aws-sdk-sts1.108.0
aws-sigv41.5.3
aws-smithy-async1.3.0
aws-smithy-eventstream0.61.4
aws-smithy-http0.64.0
aws-smithy-http-client1.4.2
aws-smithy-json0.63.1
aws-smithy-observability0.3.0
aws-smithy-query0.61.1
aws-smithy-runtime1.14.2
aws-smithy-runtime-api1.16.2
aws-smithy-runtime-api-macros1.1.0proc macro
aws-smithy-schema0.2.1
aws-smithy-types1.6.4
aws-smithy-xml0.61.1
aws-types1.6.0build script, not run
axum0.8.9
axum-core0.5.6
azure_core1.1.0build script, not run
azure_core_macros1.0.0proc macro
azure_identity1.0.0
base640.13.1
base640.22.1
base640.23.1
base64-simd0.8.0
bit-set0.8.0
bit-vec0.8.0
bit-vec0.9.1
bitflags1.3.2
bitflags2.13.1
block-buffer0.10.4
block-buffer0.12.1
bollard0.20.2
bollard-buildkit-proto0.7.0build script, not run
bollard-stubs1.52.1-rc.29.1.3
bs580.5.1
bstr1.13.1
bumpalo3.20.3
byteorder1.5.0
bytes1.12.1
bytes-utils0.1.4
cast0.3.0
castaway0.2.4
cc1.3.0
cfg-if1.0.4
cfg_aliases0.2.2
chacha200.10.1
chrono0.4.45
ciborium0.2.2
ciborium-io0.2.2
ciborium-ll0.2.2
clap4.6.7
clap_builder4.6.7
clap_lex1.1.0
cmake0.1.58
cmov0.5.4
combine4.6.8
compact_str0.9.1
compression-codecs0.4.41
compression-core0.4.33
const-oid0.10.2
core-foundation0.10.1
core-foundation-sys0.8.7
cpufeatures0.2.17
cpufeatures0.3.0
crc3.4.0
crc-catalog2.5.0
crc160.4.0build script, not run
crc32c0.6.8build script, not run
crc32fast1.5.1build script, not run
criterion0.8.2
criterion-plot0.8.2
crossbeam-channel0.5.17
crossbeam-deque0.8.7build script, not run
crossbeam-epoch0.9.20build script, not run
crossbeam-queue0.3.14
crossbeam-utils0.8.22build script, not run
crunchy0.2.4build script, not run
crypto-common0.1.7
crypto-common0.2.2
ctutils0.4.2
daachorse3.0.3
darling0.20.11
darling0.23.0
darling_core0.20.11
darling_core0.23.0
darling_macro0.20.11proc macro
darling_macro0.23.0proc macro
dary_heap0.3.9
data-encoding2.11.0
data-url0.3.2
deadpool0.12.3
deadpool-runtime0.1.4
defmt1.1.1build script, not run
defmt-macros1.1.1build script, not runproc macro
defmt-parser1.0.0
der-parser10.0.0
deranged0.5.8
derive_builder0.20.2
derive_builder_core0.20.2
derive_builder_macro0.20.2proc macro
digest0.10.7
digest0.11.3
displaydoc0.2.6proc macro
docker_credential1.4.0
dotenvy0.15.7
dunce1.0.5
dyn-clone1.0.20
either1.16.0
encoding_rs0.8.35
equivalent1.0.2
errno0.3.14
esaxx-rs0.1.10build script, not run
etcetera0.11.0
event-listener5.4.2
event-listener-strategy0.5.4
fancy-regex0.17.0
fancy-regex0.19.2
fastrand2.5.0
ferroid2.0.0
find-msvc-tools0.1.9
flate21.1.10
flume0.12.0
fnv1.0.7
foldhash0.2.0
form_urlencoded1.2.2
fs_extra1.3.0
futures0.3.33
futures-channel0.3.33
futures-core0.3.33
futures-executor0.3.33
futures-intrusive0.5.0
futures-io0.3.33
futures-macro0.3.33proc macro
futures-sink0.3.33
futures-task0.3.33
futures-timer3.0.4
futures-util0.3.33
gcp_auth0.12.7
generic-array0.14.7build script, not run
getrandom0.2.17
getrandom0.3.4build script, not run
getrandom0.4.3build script, not run
glob0.3.4
google-cloud-auth1.16.0build script, not run
google-cloud-gax1.14.0
google-cloud-gax-internal0.7.18build script, not run
google-cloud-iam-v11.12.0
google-cloud-kms-v11.14.0
google-cloud-location1.11.0
google-cloud-longrunning1.13.0
google-cloud-lro1.10.0
google-cloud-rpc1.6.0
google-cloud-type1.6.0
google-cloud-wkt1.7.0
h20.3.27
h20.4.15
half2.7.1
hashbrown0.12.3
hashbrown0.16.1
hashbrown0.17.1
hashlink0.11.1
heck0.5.0
hermit-abi0.5.3
hex0.4.3
hkdf0.13.0
hmac0.13.0
home0.5.12
http0.2.12
http1.4.2
http-body0.4.6
http-body1.1.0
http-body-util0.1.4
httparse1.10.1build script, not run
httpdate1.0.3
hybrid-array0.4.13
hyper0.14.32
hyper1.10.1
hyper-named-pipe0.1.1
hyper-rustls0.24.2
hyper-rustls0.27.9
hyper-timeout0.5.2
hyper-util0.1.20
hyperlocal0.9.1
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.2.0
icu_locale_core2.2.0
icu_normalizer2.2.0
icu_normalizer_data2.2.0build script, not run
icu_properties2.2.0
icu_properties_data2.2.0build script, not run
icu_provider2.2.0
ident_case1.0.1
idna1.1.0
idna_adapter1.2.2
indexmap1.9.3build script, not run
indexmap2.14.0
ipnet2.12.0
iter-read1.1.0
itertools0.13.0
itertools0.14.0
itoa1.0.18
jiff0.2.37
jiff-core0.1.1
jiff-static0.2.37proc macro
jni0.22.4build script, not run
jni-macros0.22.4build script, not runproc macro
jni-sys0.4.1
jni-sys-macros0.4.1proc macro
jobserver0.1.35
js-sys0.3.103
lazy_static1.5.0
libc0.2.186build script, not run
libsqlite3-sys0.37.0build script, not run
linux-raw-sys0.12.1
litemap0.8.2
lock_api0.4.14
log0.4.33
lru-slab0.1.2
macro_rules_attribute0.2.3
macro_rules_attribute-proc_macro0.2.3proc macro
matchit0.8.4
md-50.11.0
memchr2.8.3
mime0.3.17
mime_guess2.0.5build script, not run
minimal-lexical0.2.1
miniz_oxide0.9.1
mio1.2.2
moka0.12.16
monostate0.1.18
monostate-impl0.1.18proc macro
nom7.1.3
num0.4.3
num-bigint0.4.8
num-bigint0.5.1
num-complex0.4.6
num-conv0.2.2
num-integer0.1.46
num-iter0.1.46
num-rational0.4.2
num-traits0.2.19build script, not run
num_cpus1.17.0
oid-registry0.8.1build script, not run
once_cell1.21.4
onig6.5.3
onig_sys69.9.3build script, not run
oorandom11.1.5
openssl-probe0.2.1
opentelemetry0.32.0
opentelemetry-semantic-conventions0.32.1
opentelemetry_sdk0.32.1
outref0.5.2
page_size0.6.0
parking2.2.1
parking_lot0.12.5
parking_lot_core0.9.12build script, not run
parse-display0.9.1
parse-display-derive0.9.1proc macro
paste1.0.15build script, not runproc macro
pastey0.2.3proc macro
pem4.0.0
percent-encoding2.3.2
pest2.9.1
pest_derive2.9.1proc macro
pest_generator2.9.1
pest_meta2.9.1
pin-project1.1.13
pin-project-internal1.1.13proc macro
pin-project-lite0.2.17
pin-utils0.1.0
pkg-config0.3.33
plotters0.3.7
plotters-backend0.3.7
plotters-svg0.3.7
portable-atomic1.14.0build script, not run
portable-atomic-util0.2.8build script, not run
potential_utf0.1.5
powerfmt0.2.0
ppv-lite860.2.21
proc-macro-crate3.5.0
proc-macro21.0.107build script, not run
proptest1.11.0
prost0.14.4
prost-derive0.14.4proc macro
prost-types0.14.4
py_literal0.4.0
pyo30.29.2build script, not run
pyo3-async-runtimes0.29.0
pyo3-build-config0.29.2
pyo3-ffi0.29.2build script, not run
pyo3-macros0.29.2proc macro
pyo3-macros-backend0.29.2
pythonize0.29.0
quick-error1.2.3
quinn0.11.11build script, not run
quinn-proto0.11.16
quinn-udp0.5.15build script, not run
quote1.0.47build script, not run
r-efi5.3.0
r-efi6.0.0
r2d20.8.10
rand0.10.2
rand0.8.7
rand0.9.5
rand_chacha0.3.1
rand_chacha0.9.0
rand_core0.10.1
rand_core0.6.4
rand_core0.9.5
rand_pcg0.10.2
rand_xorshift0.4.0
rayon1.12.0
rayon-cond0.4.0
rayon-core1.13.0build script, not run
rcgen0.14.10
redis1.7.0
redis-test1.0.4
redox_syscall0.5.18
ref-cast1.0.27build script, not run
ref-cast-impl1.0.27proc macro
regex1.13.1
regex-automata0.4.18
regex-lite0.1.9
regex-syntax0.8.11
relative-path1.9.3
reqwest0.12.28
reqwest0.13.5
ring0.17.14build script, not runprebuilt objects
rstest0.26.1
rstest_macros0.26.1build script, not runproc macro
rustc-hash2.1.3
rustc_version0.4.1
rusticata-macros4.1.0
rustify0.7.0
rustify_derive0.5.5proc macro
rustix1.1.5build script, not run
rustls0.21.12build script, not run
rustls0.23.42build script, not run
rustls-native-certs0.8.4
rustls-pki-types1.15.0
rustls-platform-verifier0.7.0
rustls-platform-verifier-android0.1.1
rustls-webpki0.101.7
rustls-webpki0.103.13
rustversion1.0.23build script, not runproc macro
rusty-fork0.3.1
ryu1.0.23
same-file1.0.6
schannel0.1.29
scheduled-thread-pool0.2.7
schemars0.9.0
schemars1.2.2
scopeguard1.2.0
sct0.7.1
security-framework3.7.0
security-framework-sys2.17.0
semver1.0.28
serde1.0.229build script, not run
serde-pickle1.2.0
serde_core1.0.229build script, not run
serde_derive1.0.229proc macro
serde_json1.0.150build script, not run
serde_path_to_error0.1.20
serde_repr0.1.21proc macro
serde_urlencoded0.7.1
serde_with3.21.0
serde_with_macros3.21.0proc macro
sha10.10.7
sha10.11.0
sha1_smol1.0.1
sha20.10.9
sha20.11.0
sharded-slab0.1.7
shlex2.0.1
signal-hook-registry1.4.8
simd-adler320.3.10
simd_cesu81.2.0
simdutf80.1.5
slab0.4.12
smallvec1.15.2
socket20.5.10
socket20.6.5
spin0.9.9
spm_precompiled0.1.4
sqlx0.9.0
sqlx-core0.9.0
sqlx-macros0.9.0proc macro
sqlx-macros-core0.9.0
sqlx-mysql0.9.0
sqlx-postgres0.9.0
sqlx-sqlite0.9.0
stable_deref_trait1.2.1
static_assertions1.1.0
stringprep0.1.5
strsim0.11.1
structmeta0.3.0
structmeta-derive0.3.0proc macro
strum0.28.0
strum_macros0.28.0proc macro
subtle2.6.1
syn1.0.109build script, not run
syn2.0.119
syn3.0.6
sync_wrapper1.0.2
synstructure0.12.6
synstructure0.13.2
tagptr0.2.0
target-lexicon0.13.5build script, not run
tempfile3.27.0
testcontainers0.27.3
testcontainers-modules0.15.0
thiserror1.0.69build script, not run
thiserror2.0.19build script, not run
thiserror-impl1.0.69proc macro
thiserror-impl2.0.19proc macro
thread_local1.1.10
tiktoken-rs0.12.0
time0.3.53
time-core0.1.9
time-macros0.2.31proc macro
tinystr0.8.3
tinytemplate1.2.1
tinyvec1.12.0
tinyvec_macros0.1.1
tokenizers0.23.2
tokio1.53.0
tokio-macros2.7.1proc macro
tokio-rustls0.24.1
tokio-rustls0.26.4
tokio-stream0.1.19
tokio-tungstenite0.24.0
tokio-util0.7.18
toml_datetime1.1.1+spec-1.1.0
toml_edit0.25.13+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
tonic0.14.6
tonic-prost0.14.6
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-attributes0.1.31proc macro
tracing-core0.1.36
tracing-futures0.2.5
tracing-opentelemetry0.33.0
tracing-subscriber0.3.23
try-lock0.2.5
tungstenite0.24.0
typenum1.20.1
typespec1.1.0
typespec_client_core1.1.0
typespec_macros1.0.0proc macro
ucd-trie0.1.7
unarray0.1.4
unicase2.9.0
unicode-bidi0.3.18
unicode-ident1.0.24
unicode-normalization0.1.25
unicode-normalization-alignments0.1.12
unicode-properties0.1.4
unicode-segmentation1.13.3
unicode-xid0.2.6
unicode_categories0.1.1
untrusted0.9.0
ureq3.4.2
ureq-proto0.6.4
url2.5.8
urlencoding2.1.3
utf-80.7.6
utf8-zero0.8.1
utf8_iter1.0.4
uuid1.24.0
valuable0.1.1build script, not run
vaultrs0.8.0
vcpkg0.2.15prebuilt objects
veil0.3.0
veil-macros0.3.0proc macro
version_check0.9.5
vsimd0.8.0
wait-timeout0.2.1
walkdir2.5.0
want0.3.1
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.126build script, not run
wasm-bindgen-futures0.4.76
wasm-bindgen-macro0.2.126proc macro
wasm-bindgen-macro-support0.2.126
wasm-bindgen-shared0.2.126build script, not run
wasm-streams0.4.2
wasm-streams0.5.0
web-sys0.3.103
web-time1.1.0
webpki-root-certs1.0.9
webpki-roots1.0.9
whoami2.1.3
winapi0.3.9build script, not run
winapi-i686-pc-windows-gnu0.4.0build script, not runprebuilt objects
winapi-util0.1.11
winapi-x86_64-pc-windows-gnu0.4.0build script, not runprebuilt objects
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.4
wiremock0.6.5
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.3
x509-parser0.18.1
xattr1.6.1
xmlparser0.13.6
xxhash-rust0.8.18
yasna0.6.0
yoke0.8.3
yoke-derive0.8.2proc macro
zerocopy0.8.54build script, not run
zerocopy-derive0.8.54proc macro
zerofrom0.1.8
zerofrom-derive0.1.7proc macro
zeroize1.9.0
zerotrie0.2.4
zerovec0.11.6
zerovec-derive0.11.3proc macro
zlib-rs0.6.7
zmij1.0.23build script, not run
litellm-auth0.1.0
litellm-auth-aws0.1.0
litellm-auth-azure0.1.0
litellm-auth-gcp0.1.0
litellm-auth-types0.1.0
litellm-cache0.1.0
litellm-cache-gcs0.1.0
litellm-cache-memory0.1.0
litellm-cache-redis0.1.0
litellm-cache-response0.1.0
litellm-cache-testing0.1.0
litellm-callbacks-legacy-python0.1.0
litellm-core-utils0.1.0
litellm-coroutine0.1.0
litellm-framer0.1.0
litellm-host0.1.0
litellm-host-native0.1.0
litellm-host-python0.1.0
litellm-http0.1.0
litellm-inference0.1.0
litellm-inference-chat0.1.0
litellm-inference-messages0.1.0
litellm-inference-ocr0.1.0
litellm-inference-responses0.1.0
litellm-inference-testing0.1.0
litellm-inference-transcription0.1.0
litellm-llms0.1.0
litellm-llms-types0.1.0
litellm-python-bridge0.1.0build script, not run
litellm-python-compat0.1.0
litellm-router-types0.1.0
litellm-secrets0.1.0
litellm-secrets-aws0.1.0
litellm-secrets-azure0.1.0
litellm-secrets-cyberark0.1.0
litellm-secrets-google0.1.0
litellm-secrets-hashicorp0.1.0
litellm-secrets-types0.1.0
litellm-spend-clickhouse0.1.0
litellm-storage-clickhouse0.1.0
litellm-token-counter0.1.0
litellm-token-counter-fast0.1.0
litellm-token-counter-huggingface0.1.0
litellm-token-counter-tiktoken0.1.0
litellm-tracing0.1.0
Versions1RiskVulnsPublished
1.107.0criticalnone1d ago

Raw data

capture
1.7 MB
records
216,782
bytes per record
7.6

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-import success · Generated 2026-10-22 · run litellm-1.107.0

analysis 0.1.0+g579cd6c9160d.dirty · graph v2

litellm 1.107.0

maliciousCovers 1.107.0Reviewed by BitbisonUpdated 2026-10-22

LiteLLM's hijacked release pipeline shipped a credential stealer in every wheel.

As of 22 October 2026.

On 21 October 2026 LiteLLM's own release pipeline published litellm 1.107.0 to PyPI. Every wheel in the release carried a credential stealer. So did LiteLLM's Docker images for about two and a half hours. The stealer ran each time Python started in an environment that had the release installed. It collected cloud, CI and developer credentials and sent them to www.litellm.dev. It also left behind a process that checks in every hour for more code to run.

PyPI had removed the release within 1 hour 44 minutes. The collection server stopped resolving the next morning. This is the second time litellm has been compromised on PyPI this year, after 1.82.7 and 1.82.8 in March.

Today a compromise like this is usually found after someone has been breached. By then the infected release is already installed and deployed. litellm 1.107.0 was downloaded 49,043 times before PyPI removed it.

Bitbison directly detects the attack before LiteLLM is pulled into your build and in builds using the compromised release, without knowing the payload in advance or waiting for a CVE.

Timeline

All times are UTC.

WhenWhat happened
13 Oct 00:45litellm.dev is registered. (domain registry)
Before 21 OctLiteLLM believes the attacker took developers' GitHub CLI tokens from the logs of an internal LiteLLM deployment. (LiteLLM's postmortem)
21 Oct 10:08A privileged developer's token overrides branch protection on LiteLLM's release workflow. The workflow is changed to build from a lookalike repository, Berri-AI/litellm. (LiteLLM's postmortem)
21 Oct 11:11A second developer's token passes the production approval. (LiteLLM's postmortem)
21 Oct 11:39 to 11:40litellm 1.107.0 is uploaded to PyPI through Trusted Publishing. It has seven wheels and a source distribution. All seven wheels carry the payload. The source distribution does not.
21 Oct 11:47LiteLLM's Docker images are published with the payload under v1.107.0, latest, main-latest and main-stable. (LiteLLM's postmortem)
21 Oct 11:54A third developer's credentials delete the release workflow's run records. (LiteLLM's postmortem)
21 Oct 12:06The compromise is reported on LiteLLM's GitHub issue tracker. (issue 47826)
21 Oct, by 13:23PyPI has removed the release. It was downloaded 49,043 times. (PyPI download statistics)
21 Oct 14:20The affected Docker tags are removed or pointed back at clean images. (LiteLLM's postmortem)
21 Oct, after 13:23Public PyPI mirrors still serve the files. Bitbison's copies came from one of them. They match the hashes PyPI published.
22 Oct 02:07Bitbison runs the release in a customer-style CI job. The job builds a service that depends on LiteLLM, using uv. www.litellm.dev is up and accepts every upload.
22 Oct 02:26Bitbison runs the same job with litellm 1.106.2, the last clean release. None of this behavior shows up.
22 Oct 04:15Bitbison runs 1.107.0 through its registry detonation. It records the whole chain, uploads included.
22 Oct, between 04:17 and 05:14www.litellm.dev stops resolving.
22 Oct 05:14A second detonation shows the same collection. Nothing is uploaded because the server no longer resolves.

What the payload does

Each wheel puts three files at the top of site-packages. They are cook.pth, cook.py and sitecustomize.py. Python reads every .pth file there when it starts, and cook.pth imports cook. So the payload runs every time Python starts in that environment, before the program's own code. Nothing has to import litellm. On Debian and Ubuntu the system's own sitecustomize comes first, so cook.pth is the file that runs there.

The payload starts a background thread. In Bitbison's runs that thread did six things in order.

  1. It recorded the host's uptime, hostname, network addresses, routes, neighbors and listening sockets.
  2. It read credential files. They included cloud keys for AWS, Google Cloud and Azure. They included SSH keys and tokens for npm, PyPI, crates.io, Docker, GitHub, Vault and Hugging Face. It also read git credentials, .netrc and .env files.
  3. It asked the cloud metadata service for the machine's identity and role credentials on AWS, Google Cloud and Azure.
  4. It called AWS STS to check the keys it found.
  5. It sent what it collected to www.litellm.dev over plain HTTP.
  6. It started a detached Python process. The OSV advisory describes it as a loader that checks in every hour and runs whatever code it is sent.

The payload does this in every Python process. In a CI job that means pip, the test runner and the application each run it. A short process such as pip download can exit before the upload finishes. A longer one finishes it.

Who is affected

  • Anyone who installed a 1.107.0 wheel. That includes installs from PyPI between 11:39 and 13:23 on 21 October. It also includes later installs from a mirror, a cache or a lockfile that pins 1.107.0.
  • Anyone who pulled LiteLLM's Docker images tagged v1.107.0, latest, main-latest or main-stable between 11:47 and 14:20 on 21 October.
  • Anything built with it. A container image, a virtualenv or a bundle with 1.107.0 inside runs the payload every time Python starts, wherever it is deployed.
  • Not installs from the source distribution. It does not contain the payload. pip prefers wheels, so almost every install took a wheel.

Every credential the affected Python processes could read is at risk. That includes the cloud role of the machine they ran on.

What to do

  • Search lockfiles, image layers and environments for litellm 1.107.0. Look for cook.pth at the top of a site-packages directory too.
  • Do not run Python in an affected environment until the files are gone. Even pip uninstall starts Python and runs the payload again.
  • Stop the detached loader. It holds /tmp/remote_code_loader.lock.
  • Delete cook.pth, cook.py and sitecustomize.py from any affected site-packages. Then install 1.106.2 or rebuild the image from a clean one.
  • Rotate every credential an affected environment could read, including the machine's cloud role.
  • Block www.litellm.dev.

Indicators

IndicatorValue
Packagelitellm 1.107.0 on PyPI (OSV MAL-2026-2144)
Files installedcook.pth, cook.py, sitecustomize.py at the top of site-packages
Running loadera process holding /tmp/remote_code_loader.lock
Collection serverwww.litellm.dev, plain HTTP on port 80
Docker image indexsha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e
Wheel (one of seven)litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl, sha256 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7
Source distribution (no payload)litellm-1.107.0.tar.gz, sha256 2befe2a79fb4fbbd9a543b5b40b530c8cffa8771bab22b8fb22b2e4ae3b1f819

Why this release was hard to catch

  • It came from the real pipeline. LiteLLM's own workflow built and published it with Trusted Publishing. A check that trusts the publisher or the attestation lets it through.
  • The source looked clean. The source distribution has none of the payload's files. Its build settings name a cook directory it does not ship, and that is the only trace.
  • It needs no import. The payload runs when Python starts. A scan that only follows what a program imports misses it.

How Bitbison detects it

Bitbison detects this attack in two places. The first is when the release is published. The second is when a build installs it. Both look at what the release contains, how the build behaves and where its data flows. Neither uses a signature for this payload.

Sources

Indicators

hosts
www.litellm.dev
files
cook.pthcook.pysitecustomize.py/tmp/remote_code_loader.lock

Examined

1.107.0
sha256:462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7

Links