AI Proxy Library LiteLLM Hit by Supply Chain Attack; Malicious v1.107.0 Steals Cloud and Model API Keys

Security firm Wiz Research disclosed on October 21, 2026, that the popular Python LLM proxy library LiteLLM was targeted by a supply chain attack. Attackers published a malicious version, v1.107.0, which remained available on PyPI for approximately two hours before being quarantined. Simultaneously, related image tags on GHCR and Docker Hub (including latest, main-latest, etc.) were trojanized until they were removed around 13:53 UTC. The most recent safe version is v1.106.2.

According to analyses by Wiz and Datadog Security Labs, the malicious package extracts three files (cook.pth, cook.py, and sitecustomize.py) into the site-packages root directory upon installation. These files are designed to execute automatically whenever a Python interpreter starts, triggering even if LiteLLM is not imported. Specifically, cook.py contains a credential stealer named privcollect, which harvests sensitive data across 16 modules targeting browser credentials from Chrome/Firefox, AWS/GCP/Azure cloud credentials, SSH/GPG keys, and API keys for LLM providers like OpenAI and Anthropic stored in environment variables or config files. It also directly queries the LiteLLM Proxy's PostgreSQL database to extract upstream provider credentials.

The harvested data is encrypted with AES-256-CBC and exfiltrated via HTTP POST requests to the attacker-controlled lookalike domain www.litellm[.]dev/healthcheck ↗. The sitecustomize.py file includes an hourly backdoor mechanism checking a GitHub dead drop to download second-stage RAT payloads, although no active payload was observed in the dead drop at the time of analysis. Wiz noted that this dual-technique approach using both .pth files and sitecustomize.py appears to be the first documented case in the wild.