# LiteLLM compromised again: infostealer and RAT found in version 1.107.0

Attacker abused maturin's data directive to bundle cook.pth, cook.py and sitecustomize.py into LiteLLM 1.107.0 wheels, stealing credentials and installing a RAT.

- Payout: Real-world hack
- Severity: critical
- Program: LiteLLM
- Analysis by: Aikido Security
- Disclosed: 2026-10-21
- Write-up quality: 7/10
- Original: https://www.aikido.dev/blog/litellm-compromised-infostealer-rat
- Library page: https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-litellm-compromised-infostealer-rat
- Tags: area:oss domain:oss impact:data-leak impact:rce kind:incident platform:threat-intel sev:critical tech:python technique:chained technique:source-review vuln:dependency-confusion vuln:rce vuln:secrets-leak

**Target:** PyPI wheels and Docker image of litellm 1.107.0
**Root cause:** The pyproject.toml [tool.maturin] data = "cook" directive caused maturin to bundle a directory absent from source into the wheel's data section, dropping files into site-packages. cook.pth and sitecustomize.py then auto-execute at every Python interpreter startup.
**Steps:**
1. Observe pyproject.toml contains `[tool.maturin] data = "cook"` while no cook/ directory exists in the source tarball or GitHub repo
2. Build environment creates cook/ containing cook.pth (`import cook`), cook.py (obfuscated 61KB infostealer) and sitecustomize.py (RAT daemon)
3. maturin bundles cook/ into wheel data section; wheels uploaded to PyPI and Docker image pushed
4. On install, cook.pth in site-packages triggers `import cook` at every interpreter start, running the infostealer once (sentinel `/tmp/.pc_once_72129118c59f5636c0bb`)
5. sitecustomize.py forks a daemon holding `/tmp/remote_code_loader.lock`, polling `raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt` hourly then `exec`-ing `http://{domain}/codepy`
6. Check for `/tmp/.pc_once_*` and `/tmp/remote_code_loader.lock` to confirm compromise
**How found:** Analysts noticed the `data = "cook"` maturin directive in pyproject.toml referencing a directory that does not exist in the source repo, indicating build-environment tampering; wheel contents and site-packages files were then inspected.
**Exploitation:** Infostealer harvests browser passwords/history, SSH keys, shell history, AWS/Azure/GCP creds and live IMDS tokens, Docker/K8s/CI-CD secrets, AI tool configs, GPG/TLS keys, all process environs via /proc/<pid>/environ, and LiteLLM DB credential tables; encrypts with RSA-4096 and POSTs to http://www.litellm.dev/healthcheck with header `X-Token: XWiA8gZNa7NcX2XRoAEb`. RAT daemon fetches C2 domain from GitHub dead-drop and execs arbitrary Python hourly with full process privileges.
**Escalation:** RAT enables persistent arbitrary code execution, lateral movement, further exfiltration and payload deployment on every infected host; stolen cloud/CI credentials enable supply-chain pivot.
**Insight:** Audit build-tool directives (maturin `data`, setuptools `package_data`, MANIFEST.in) for paths absent from the source tree, and diff published wheel contents against the sdist — .pth and sitecustomize.py in site-packages are auto-executed at interpreter startup and are prime injection points.