# LiteLLM Compromised, Steals Credentials

Malicious LiteLLM 1.107.0 on PyPI/Docker used .pth and sitecustomize.py to steal cloud, browser and LLM credentials, exfiltrating to a lookalike domain.

- Payout: Real-world hack
- Severity: critical
- Program: LiteLLM
- Analysis by: Wiz Research
- Disclosed: 2026-10-21
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/litellm-compromised-steals-credentials
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-litellm-compromised-steals-credentials
- Tags: area:oss domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:aws tech:ci-cd tech:github-actions tech:python technique:source-review vuln:misconfiguration vuln:secrets-leak

**Target:** PyPI package and GHCR/Docker Hub container images of LiteLLM
**Root cause:** Stolen GitHub CLI OAuth tokens (leaked into LiteLLM logs via Claude Code responses) let attackers push commits to a lookalike Berri-AI repo and trigger/approve the release workflow, bundling cook.pth/cook.py/sitecustomize.py into the wheel and Docker images.
**Steps:**
1. Attacker obtains GitHub CLI OAuth tokens from logs of an exposed internal LiteLLM deployment
2. Push commits to github.com/Berri-AI/litellm adding `cook.pth`, `cook.py`, `sitecustomize.py` and bumping version to 1.107.0
3. Add `data = "cook"` to pyproject.toml so build bundles malware into wheel; add `COPY cook ./cook` to Dockerfiles
4. Trigger project-releaser workflow from one account, approve from another; publish to PyPI and GHCR/Docker Hub
5. On install, `cook.pth` imports `cook`, which deobfuscates, runs stealer, writes `/tmp/.pc_once_72129118c59f5636c0bb`
6. Stealer harvests browser, AWS/GCP/Azure, SSH/GPG, LLM API keys and queries `SELECT * FROM "LiteLLM_CredentialsTable" LIMIT 500`
7. Encrypt with AES-256-CBC (RSA-4096-wrapped key), POST to `www.litellm.dev/healthcheck` with `X-Token: XWiA8gZNa7NcX2XRoAEb`
8. `sitecustomize.py` fetches `domain.txt` from GitHub dead drop and downloads second stage from `http://<domain>/codepy`
**How found:** Wiz detected the malicious PyPI release and Docker tags, analyzed the wheel contents (cook.pth/cook.py/sitecustomize.py), traced commits via Git fork object sharing, and correlated post-exfil AWS API calls from attacker IPs.
**Exploitation:** Victims installing 1.107.0 auto-execute the stealer at interpreter startup; harvested credentials are AES/RSA-encrypted and exfiltrated over HTTP to the attacker's lookalike domain. Wiz observed attacker validating stolen AWS instance-role credentials ~4.5h later via sts:GetCallerIdentity, bedrock:ListFoundationModels and ListModels (LLMjacking), plus IAM enumeration in some environments.
**Escalation:** Stolen CI runner and Kubernetes node instance-role credentials were used to pivot into AWS accounts, enumerate IAM and access Bedrock models for LLMjacking.
**Insight:** `.pth` files and `sitecustomize.py` in site-packages root execute on every interpreter start — audit wheels for these filenames and for `data =` directives in pyproject.toml that bundle non-package files; also treat CI logs as a credential source since tools can echo OAuth tokens into response bodies.