The LiteLLM project, a popular Python interface and proxy for large language model (LLM) providers, was recently targeted in a supply chain attack involving version 1.107.0. Security researchers identified that while the upstream GitHub repository remained clean, the distributed 'wheels' (pre-compiled Python packages) on PyPI contained three malicious files: `cook.pth`, `cook.py`, and `sitecustomize.py`. These files were designed to execute automatically whenever a Python process started on a host, regardless of whether the application actually imported the LiteLLM library.
The image serves as a primary visual for the LiteLLM supply chain attack involving version 1.107.0.
The compromise functioned through two primary mechanisms. First, `cook.pth` acted as a startup hook that imported `cook.py`, which contained a credential stealer named 'privcollect'. This stealer targeted a wide array of sensitive data, including SSH keys, cloud credentials (AWS, Azure, GCP), browser passwords, and even the API keys for LLM providers stored in LiteLLM proxy databases. It encrypted this data and exfiltrated it to a remote server. Second, `sitecustomize.py` initiated a background daemon that checked a remote GitHub repository every hour for a new domain. If found, the daemon would download and execute a second-stage payload, providing the attacker with a persistent remote code execution (RCE) channel.
Analysis of the build artifacts suggests the injection occurred during the wheel construction process rather than through a simple manual upload of a modified ZIP file. The `pyproject.toml` file in the source distribution contained a specific instruction (`data = "cook"`) that directed the build tool, Maturin, to include a folder named `cook` in the final package. Because this folder and its contents were absent from the public Git repository, the malicious code was only visible to users who downloaded the compiled wheel. Researchers believe the attack likely originated from a compromised private release pipeline, a stolen maintainer credential, or a compromised private branch, as the malicious wheels matched the output of the project's standard build pipeline. PyPI has since removed the affected release, and users are advised to pin their versions to 1.106.2 or earlier.