Threat Intelligence Report: LiteLLM 1.107.0 Supply Chain Compromise

Scope: October's compromised LiteLLM 1.107.0 release, with an archive review covering 2026-07-25 through 2026-10-25. Intelligence was obtained exclusively through TI Mindmap HUB MCP. No external webpages, package downloads or live infrastructure were accessed. Report counts describe documents, not independent investigations or victims.

Evidence convention: statements attributed to publishers are supported by HUB's retrieved summaries, IOC records and available article content; artifacts were not independently executed or hashed. Recommendations and analytical ATT&CK mappings are distinguished from observed activity. Classification is assigned to this synthesis, not asserted for every underlying source.

1. Reports Summary Table

Eight incident reports from seven publishers form the core corpus. Three unique historical articles provide background, yielding 11 included articles from seven publishers. Dates are HUB record dates: the returned publication and ingestion fields commonly coincide, so they are not independently verified original publication dates.

Deduplication and exclusions. HUB's September 10 Off Guard record points to the same original article as row 9 and is not a second source. General weekly roundups were not added merely because they mention LiteLLM. An August-ingested Resecurity/SANDCLOCK retrospective describes the separate March campaign; restricted source content is not reproduced or included in this report's source count. March incident reports returned by the archive search are outside the requested document window.

2. Executive Summary

Overview

On October 21, 2026, attackers distributed malicious LiteLLM 1.107.0 wheels through PyPI and compromised container artifacts through official distribution channels. The release installed Python startup implants that could execute when an affected interpreter started, without importing LiteLLM. Developer workstations, CI/CD runners, containers and AI gateway environments were consequently in scope.

The implant combined credential collection, encrypted exfiltration and a remote-loader capability. Startup components were installed into the Python environment's library path, outside the ordinary LiteLLM package directory. Removing only that package directory could leave execution hooks behind. Wiz reports approximately 49,000 downloads; that is not a count of infected endpoints, victims or successful exfiltrations.

Socket subsequently identified successful secret-stealing GitHub Actions workflows on October 10 and October 12, establishing upstream repository access at least 11 days before malicious distribution. Those findings extend the repository investigation window, but the retrieved evidence does not establish the precise causal bridge between those stolen secrets and the October 21 release.

Diagram: Attack Flow Overview

Oct 10/12: temporary upstream branches execute secret-stealing workflows
                |
                | earlier access established; causal bridge unresolved
                v
Reported developer credential compromise / release workflow modification
                |
Lookalike Berri-AI/litellm source -> malicious 1.107.0 artifacts
                |
                +--> PyPI platform wheels
                +--> Container images and affected floating tags
                            |
Python initialization -> cook.pth / cook.py / sitecustomize.py
                            |
                +-----------+----------------------+
                v                                  v
Credential collection -> encrypted upload    Remote loader / GitHub pointer
Cloud, AI, developer and browser secrets     Second-stage retrieval capability

Attribution & Threat Actor

October operator: unattributed in the available evidence. Microsoft did not independently determine how the developer accounts were initially compromised. Wiz and Datadog relay investigative explanations involving developer GitHub OAuth credentials; Wiz discusses possible token exposure through retained AI-assistant responses and an exposed internal deployment. These explanations should not be promoted into a proven initial-access chain.

Do not attribute October to TeamPCP by association. The earlier LiteLLM/Trivy incident and this release share victim software and credential-theft objectives, but the retrieved material does not establish common operators. Datadog explicitly does not establish a connection to the earlier campaign.

Three-Month Historical Assessment

Finding: relevant documentation does go back to August, but the selected corpus does not demonstrate that October's 1.107.0 supply-chain incident was already active in August or September. Hunt the publisher repository from October 10 at minimum, and consumer systems from their first contact with affected artifacts.

3. Technical Details

3.1 Malware Analysis

Stage 0: Upstream Access and Secret Harvesting

Socket identified two unsigned commits creating .github/workflows/cache.yml under the misleading subject ci: bump cache config. Temporary branches ci-tmp-a351cc and ci-tmp-4d8517 were pushed, their workflows executed in the upstream repository, and the branches were deleted. The first run lasted approximately four seconds; the second expanded to six jobs and multiple environment scopes. Successful workflow execution is documented; the complete downstream use of harvested secrets is not.

Stage 1: Release-Pipeline and Artifact Compromise

Socket's provenance analysis identifies Berri-AI/litellm, rather than legitimate BerriAI/litellm, revision 20535d8fa11f786a6c24df7488a0e449ed5f09ad, and workflow run 39587059944. SafeDep reports Maturin packaging configuration that included the malicious cook data directory; Socket describes its inclusion in Docker build stages.

Wheel integrity manifests contained the implants, supporting build-time inclusion. Such manifests and apparently valid provenance do not prove that source selection, approvers or the release workflow were trustworthy. The public source tag did not contain the malicious packaging change according to the retrieved reporting.

Stage 2: Startup Execution and Credential Collection

cook.pth contains an executable import of cook. Normal Python site initialization can therefore load cook.py, which Base64-decodes and zlib-decompresses the collector described as PRIVCOLLECT. sitecustomize.py provides another startup path and a Unix-oriented loader. Execution depends on the interpreter's startup behavior and environment; not every short-lived process necessarily completes collection or exfiltration.

Reported collection targets include cloud and developer configuration, AI-provider secrets, private keys, browser credential stores, environment data, shell history and selected LiteLLM database records. Datadog describes AES-256/RSA-4096 protection of collected data before upload. This is credential theft by package malware, not exploitation of a newly demonstrated Python vulnerability.

Stage 3: Exfiltration and Remote Loader

Reports identify /healthcheck uploads on attacker-associated litellm.dev infrastructure. A loader checks a GitHub-hosted pointer hourly and can retrieve additional Python code, including a /codepy endpoint. Successful second-stage retrieval is not established by the retrieved evidence; capability must not be equated with observed operator tasking.

The marker /tmp/.pc_once_72129118c59f5636c0bb is described by Microsoft, SafeDep and Socket as written after an HTTP 200 upload response. Its presence supports a completed upload transaction, not certainty about every secret collected or retained. Absence of the marker or /tmp/remote_code_loader.lock does not clear a host. Windows-specific execution limitations do not make the confirmed malicious Windows wheel safe.

3.2 Exposure Window and Source Discrepancies

3.3 Infrastructure and Downstream Exposure

Affected scope includes seven platform wheels and multiple container variants. Reported image references include ghcr.io/berriai/litellm:v1.107.0 and litellm/litellm:1.107.0; Aikido also flags latest, main-latest and main-stable. Floating tags are not immutable evidence: use digests and deployment/pull logs.

Wiz and Datadog identify 1.106.2 as a clean rollback option at reporting time. Installing it is not proof that an already exposed environment has been cleaned. Images, build caches, mirrors, virtual environments and mounted secrets may extend exposure beyond registry removal.

4. Detection Opportunities

4.1 Behavioral Detections

• Correlate Python startup with unexpected reads of cloud configuration, AI-provider secrets, browser stores and private keys, followed by archive creation or outbound uploads.
• Investigate Python processes reaching the exact exfiltration or GitHub pointer paths in section 6, including interpreters started by package-management or CI jobs.
• Inspect environment-wide library directories for startup implants, not only the LiteLLM package directory. sitecustomize.py is also legitimate functionality: filename-only matches require content or hash confirmation.
• Hunt for detached Python loaders and repeated pointer retrieval; lack of a shell child does not exclude execution.

4.2 Network-Based Detections

• Search proxy, DNS and EDR telemetry for litellm.dev, www.litellm.dev, /healthcheck and the specific letters9813/pythonclient-test raw GitHub path.
• Correlate the October 10/12 webhook paths with GitHub Actions and build-runner activity. webhook.site and GitHub are shared services, not domains to classify wholesale as malicious.
• Review cloud activity from 168.100.8[.]57 and 165.227.201[.]8 in the incident context. Wiz associates these with use of stolen AWS role credentials; they are not established as package-download or collector-exfiltration endpoints.

4.3 Host-Based Detections

• Inventory litellm==1.107.0, immutable image digests, package caches and installed wheel metadata without starting an untrusted interpreter on an exposed system.
• Check for the three startup components, collector hashes and /tmp artifacts in section 6. Marker absence is inconclusive.
• Preserve disk, volatile evidence, installation logs and cloud sessions before rebuilding. Avoid triggering the implant during investigation through routine Python or pip startup.

4.4 CI/CD and Provenance Checks

• Search repository audit records for short-lived ci-tmp-* branches, workflow creation/deletion, unexpected environment access and anomalous production approvals.
• Compare release provenance against the exact expected repository owner and workflow inputs. A repository-owner hyphen is security-relevant in this incident.
• Review secrets and tokens accessible to affected jobs, not only credentials visibly referenced in a workflow. Include mirrors, derived images and cached artifacts in the inventory.

4.5 Retrospective Hunt Window

For the upstream repository, start no later than October 10, 2026, and include October 12 workflow execution and subsequent publishing actions. For consumers, start at the first download, pull or installation of an affected artifact on October 21, extending beyond removal wherever caches or copied environments remained usable. August/September gateway-exploitation cases require their own hunts; they do not establish an earlier start for this package incident.

These are source-derived hunting recommendations, not detection rules executed or validated against an organization's telemetry.

5. Conclusion

1. This is an artifact and release-trust compromise. A clean-looking source tag or valid artifact manifest does not clear a published wheel or container.
2. Startup hooks expand the blast radius. Importing LiteLLM is not required, and uninstalling it alone can leave executable files in the environment's library path.
3. The repository compromise predates distribution. October 10/12 secret-theft workflows materially extend the upstream investigation, while their precise connection to October 21 remains unresolved.
4. Attribution remains open. The separate TeamPCP campaign must not become October attribution by repetition.
5. History matters without proving continuity. August/September reports show why AI gateways are valuable credential targets, not that the same operator or entry vector caused October's release incident.

Recommended Immediate Actions:

• Isolate affected systems and preserve artifacts, CI logs and cloud audit evidence.
• Rebuild Python environments and affected containers from verified clean inputs; do not rely on package-directory deletion or downgrade alone.
• Revoke or rotate accessible cloud, developer, browser-session and AI-provider credentials from clean systems, prioritizing those present during execution.
• Investigate use of stolen credentials, active sessions and downstream build artifacts; removing the malware does not revoke secrets already copied.
• Restore publishing only after reviewing repository access, release inputs, workflow permissions and approval boundaries.

6. Indicators of Compromise (IoC List)

Network indicators are defanged. Shared-service URLs and legitimate software paths require contextual correlation. The tables keep October indicators separate from historical gateway-exploitation cases.

6.1 Network Indicators

6.2 File Hashes - Malicious Wheels

All values are SHA-256. The seven-wheel set is reported across Wiz, Microsoft, Aikido, Datadog, SafeDep and Socket; Open Source Malware also analyzed the macOS x86-64 artifact.

6.3 File Hashes - Startup Components and Collectors

Two SafeDep-extracted startup hash strings differ from the corroborated values above. They are omitted rather than silently corrected or merged. A hash match is stronger evidence than a filename alone.

6.4 Container Digests

Values below are SHA-256 digests; prepend sha256: when querying container inventories. Index and platform-manifest digests identify different objects and are not interchangeable. Variant labels do not establish a repository/tag name.

6.5 File System and Repository Artifacts

6.6 Package and Image Identifiers

7. MITRE ATT&CK Techniques

Mappings apply to October unless marked as capability or analytical context. They are not evidence of a confirmed action in every consumer environment. Historical gateway-exploitation techniques are intentionally not transferred into this incident.

Cross-source synthesis using TI Mindmap HUB MCP only. Analysis date: 2026-10-25 | Research window: 2026-07-25 to 2026-10-25 | Included articles: 11 (8 incident, 3 context) | Classification: TLP:CLEAR.