LiteLLM 1.107.0 Breach: Python Hook Credential Theft

Introduction

Microsoft has published new analysis of the compromised LiteLLM 1.107.0 release, and the findings highlight why software supply chain attacks remain a major risk for developers and IT teams. In this case, the malicious package abused Python startup behavior so that credential theft could begin even if an application never imported LiteLLM directly.

That makes this incident more than a typical package compromise. Any affected Python environment on developer devices, build systems, test hosts, or containers may have executed the payload simply by launching Python or pip.

What’s new

Microsoft’s investigation found that the malicious LiteLLM 1.107.0 package included files placed into the Python environment’s library path:

• cook.pth
• cook.py
• sitecustomize.py

These files were designed to run during normal Python interpreter initialization.

Key findings

• Automatic execution: The payload could run when Python started, without importing LiteLLM.
• Credential theft behavior: The collector targeted developer tools, cloud credentials, browser data, SSH material, environment variables, and LiteLLM-related database data.
• Multiple execution paths: Microsoft identified both a .pth-based collector and a Unix-oriented sitecustomize.py loader.
• Potential persistence risk: Removing only the LiteLLM application directory may not remove the malicious startup files.
• Container exposure: Official container images also distributed the compromised release.

Microsoft also notes an important investigation caveat: do not start Python or pip inside a suspect environment just to check for the package, because doing so could trigger the malware.

Impact on administrators and security teams

This incident affects more than AI gateway deployments. Organizations using LiteLLM 1.107.0 on:

• Developer workstations
• CI/CD agents
• Test environments
• Containers
• Proxy servers

should treat those environments as potentially exposed.

The compromise may have allowed attackers to access API keys, cloud credentials, package manager secrets, browser-stored data, and other sensitive authentication material available to the affected identity. Microsoft also warns that deleting the package or removing a release tag is not sufficient recovery.

Recommended next steps

IT and security teams should:

• Identify any systems that installed LiteLLM 1.107.0 or used affected container images.
• Avoid launching Python in suspect environments during initial triage.
• Inspect Python library paths for cook.pth, cook.py, and sitecustomize.py.
• Terminate surviving malicious processes and rebuild or replace compromised Python environments.
• Rotate credentials that may have been accessible, including cloud, developer, and application secrets.
• Use Microsoft Defender detections and hunting guidance from Microsoft’s security blog to investigate exposure.

Bottom line

The LiteLLM 1.107.0 compromise is a high-impact Python supply chain incident because execution could happen during routine interpreter startup. For defenders, the priority is to contain affected environments, validate whether credentials were exposed, and perform full recovery rather than relying on package removal alone.