DEV Community

Shuttlewright
Shuttlewright

Posted on

Check if the LiteLLM 1.107.0 compromise hit you in 30 seconds

#python #security #supplychain #devops

On October 21, the litellm 1.107.0 release on PyPI shipped a credential stealer and a remote-code backdoor. PyPI pulled the release the same day. Only 1.107.0 is compromised: 1.106.2 and the 1.107.0 rc builds are clean.

Here is how to check whether it touched your machines.

1. Check the version 

pip freeze | grep litellm
Enter fullscreen mode Exit fullscreen mode

If nothing pins 1.107.0, the package did not install the implant on that machine. Do not stop here if you ran 1.107.0 at any point yesterday.

2. Check the host, not just the package

The implant drops files into site-packages (cook.pth, cook.py, sitecustomize.py) and runs with every Python process on the host, even one that never imports litellm. Upgrading or uninstalling the package does not remove them.

Look for those files in site-packages, and for these marker files:

  • /tmp/.pc_once_72129118c59f5636c0bb
  • /tmp/remote_code_loader.lock

Check CI runners and build containers, not just laptops. CI usually holds the more dangerous credentials.

3. If you find anything, rotate in spend order

The stealer targeted SSH keys, cloud credentials, CI/CD secrets, AI tool tokens, browser passwords and LLM provider keys. Rotate in this order:

  1. Cloud and package-publish credentials
  2. LLM provider keys
  3. Read-only tokens

Then review the last 72 hours of spend dashboards.

A free checker

We built a browser-only checklist that walks through all of this: version analysis plus the exact host-file checks. Nothing you paste leaves the browser.

LiteLLM 1.107.0 exposure check

Sources: SafeDep's writeup and the official LiteLLM incident note.

Top comments (0)