A poisoned LiteLLM release stole credentials for two hours before PyPI pulled it

A release that matches no commit in git

SafeDep's analysis starts with a mismatch: the sdist's pyproject.toml carried an injected line, data = "cook", which copied three implant files into site-packages. "The upstream GitHub source does not contain them." SafeDep assesses with moderate to high confidence that BerriAI's private release pipeline built the wheels from attacker-modified source, though only the pipeline's logs can confirm it.

One .pth file, every Python process

A .pth file, cook.pth, runs the stealer in every Python process on the machine. It goes after SSH keys, cloud and CI/CD credentials, browser passwords, AI tool tokens, the provider keys in a LiteLLM proxy's database, and AWS instance metadata. It encrypts the haul and uploads it to www.litellm[.]dev.

A second file, sitecustomize.py, starts a detached daemon that wakes hourly. It reads a server domain from a file on GitHub, reruns the stealer and executes whatever code the server returns. The GitHub account was deleted about two hours after the release, so the daemon now finds no server. Hosts that ran it earlier may already have received second-stage code.

The window, all 21 October UTC: wheels built 11:20 to 11:37, uploaded 11:39 to 11:40, GitHub release at 11:50, release gone from PyPI and the account deleted by 13:40.

"Cooldowns shorter than that seem like snake oil"

Dependency cooldowns, a delay before a new release becomes installable, were the thread's first fight.

"The last time I looked for information, I remember seeing that the median supply chain attack was in place for multiple months to years before being discovered. Cooldowns shorter than that seem like snake oil." — a commenter

The reply came from a developer whose profile points to SafeDep's pmg tool.

"Even dependency cooldown of 24h is enough to protect the consumers from these breaches." — a developer whose profile links SafeDep's pmg

This release lived for about two hours. Cooldowns have a cost too: an engineer running a seven-day cooldown on an internal PyPI proxy says it also delays security updates, which they now exclude by hand.

Sandboxes: stopped, or ignored after the hundredth prompt

Another commenter doubted that sandboxing helps at all.

"At one point permission pop-up fatigue sets in we start giving any permission as if it's normal." — a commenter

Not everyone agreed.

"No, you can block this with sandboxing tools." — a user who runs his coding agents behind the Nono sandbox

His setup routes agent traffic through a proxy that injects credentials, so the agent never holds the real keys.

LiteLLM is a repeat target. One developer dug up an old audit script from March:

"This is the second significant exploit against LiteLLM in what, a year or two ?"

Because a LiteLLM proxy stores provider keys for every model a company calls, anyone who installed 1.107.0 should treat every credential on that host as stolen and rotate it before checking for the three files.