LiteLLM 1.107.0: do not run pip to inspect the suspect environment
Microsoft describes a compromised LiteLLM release that can execute during Python startup without importing the package. Investigate from a known-clean environment.
Going deeper
Generated image · SecuFocus
At a glance
Key points
Did a workstation, image or build agent install LiteLLM 1.107.0? Do not start Python or pip inside that environment to check its version. Microsoft’s 23 October analysis describes files executed during Python initialization. Isolate the environment, inspect it with trusted tools from a clean system, then rebuild and revoke exposed access.
The package does not have to be imported
According to Microsoft Threat Intelligence, the compromised LiteLLM 1.107.0 release reached PyPI and official container images on 21 October. Its payload uses Python startup mechanisms: cook.pth can load cook.py, while sitecustomize.py provides another route. These files sit in the environment’s library directory, outside the litellm application folder.
Microsoft describes a Windows case where an ordinary Python invocation to install an unrelated dependency activated the collector. An application did not have to use the LiteLLM gateway. Developer workstations, CI/CD agents, test systems and containers also belong in the exposure review.
Inspect without starting the interpreter
Microsoft recommends not running python, pip or a tool that invokes the affected interpreter during evidence collection. Isolate affected copies and, where operationally safe, stop Python processes and prevent automation from restarting them. Have the files inspected from a known-clean system using trusted tools.
Look for the release in caches, internal mirrors, lock files, build outputs and images as well. A container tag can change its content: record its immutable digest. Do not download a compromised sample to reproduce the attack on your workstation.
The process’s access defines the potential damage
The analyzed collector targets credentials for AI providers, development tools, cloud services, browsers and infrastructure, along with SSH keys and selected LiteLLM proxy data. A target appearing in the code does not prove it was read or exfiltrated on every machine.
From a clean machine, revoke or rotate credentials reachable by the compromised identity and invalidate affected sessions. Replacing a key does not necessarily close every token or session already issued. A locally installed agent can also hold remote access: limit what you entrust to it.
Deleting the LiteLLM directory is not enough
Startup files can survive removal of the application directory alone. Microsoft recommends rebuilding from verified artifacts and checking startup files and surviving processes. The analysis does not identify a replacement release we could safely tell you to install without further verification.
The second mechanism can retrieve remote code on Unix systems, but Microsoft says that retrieval and execution were not confirmed. Correlate files, hashes, processes, network evidence and identity use before reaching a verdict. SecuFocus has neither executed the samples nor inspected your environment.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.