LiteLLM 1.107.0 PyPI Release Compromised with Credential Stealer and RCE

LiteLLM 1.107.0 on PyPI shipped with two malicious payloads executing automatically whenever Python started, even if the library wasn’t imported. A credential stealer harvested SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords, and LiteLLM database contents, encrypting and exfiltrating them to a remote server. A backdoor spawned a persistent daemon checking an attacker-controlled GitHub repository hourly for remote code execution instructions.

The attacker injected malicious code into the build configuration and compromised BerriAI’s internal release pipeline to distribute the poisoned wheels across all seven distributions. Analysis shows the published binaries diverged from public GitHub source, indicating pipeline compromise rather than credential theft. The backdoor’s GitHub repository was deleted within two hours, though systems infected earlier could have received second-stage payloads. PyPI removed the release; other versions and upstream code remained clean.