Malicious LiteLLM PyPI Release Steals Secrets and Installs Persistent Python Backdoor

Security researchers reported a supply-chain compromise of LiteLLM version 1.107.0 on PyPI, involving a credential stealer and persistent Python backdoor. The malicious payload reportedly executes during Python initialization without requiring an explicit LiteLLM import, collects secrets across 16 categories and LiteLLM database records, encrypts the data, and exfiltrates it to http://www[.]litellm[.]dev/healthcheck. A separate daemon retrieves a changeable command-and-control hostname from GitHub and downloads and executes remote Python code. That remote payload was unavailable during analysis, leaving its downstream behavior unresolved.

The discovery follows malicious LiteLLM releases 1.82.7 and 1.82.8 in March, which OpenSourceMalware attributed to TeamPCP reusing maintainer credentials stolen during an earlier Trivy compromise; PyPI quarantined those releases roughly three hours later. That attribution has not been established for version 1.107.0 in the supplied reports. GMO Flatt Security identified 1.106.2 as safe and urged potentially affected users to immediately rotate exposed credentials and keys. Organizations should identify affected installations, remove the compromised release, and investigate possible exfiltration and persistence rather than treating a package downgrade alone as remediation. The latest findings remain preliminary.