{"id":183962,"date":"2026-10-22T17:40:40","date_gmt":"2026-10-22T15:40:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/v-pypi-paket-i-docker-obraz-s-litellm-podstavleno-vredonosnoe-po"},"modified":"2026-10-22T17:40:45","modified_gmt":"2026-10-22T15:40:45","slug":"malware-injected-into-litellm-pypi-package-and-docker-image","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/malware-injected-into-litellm-pypi-package-and-docker-image","title":{"rendered":"Malicious software has been injected into the PyPI package and Docker image with LiteLLM.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A malicious release of the LiteLLM library has been spotted on the PyPI repository, which has 23 million downloads per week, alongside the injection of malicious code into the project's official Docker image. This is not the first such incident involving LiteLLM \u2014 in March of this year, attackers had already published malicious releases after intercepting the maintainer's credentials. This time, the attackers uploaded LiteLLM version 1.107.0, which contained malicious code designed for remote command execution, as well as the retrieval and transmission of credentials, keys, and access tokens.<\/p>\n
The malicious code was inserted during the build process without compromising the git repository. After installation, the malicious code activates before importing LiteLLM through the installation of the cook.pth, cook.py, and sitecustomize.py files in the Python libraries directory. These files are executed each time Python is run in the system without any user action required. <\/p>\n
Initially, Python runs the file cook.pth, which contains a single line: 'import cook' to import the cook.py script that collects credentials. Next, the script sitecustomize.py is imported, which is used to load external code in the background (the loading parameters are defined via the link 'raw.githubusercontent.com\/letters9813\/pythonclient-test\/main\/domain.txt'). The malicious code in both scripts is compressed using zlib and encoded in Base64. A sign of compromise may be the appearance of files in the system named '\/tmp\/.pc_once_*' and '\/tmp\/remote_code_loader.lock'.<\/p>\n
After activation, the cook.py file scans the connection parameters for cloud services, repositories, and continuous integration systems (AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub CLI, Vault, Terraform, Packer), developer accounts, Git connection settings, npm and PyPI settings, files with environment variables, private keys for SSH, PGP, and TLS, AI tool settings, browser databases with cookies, stored data and history, information about processes, and environment variables. The discovered data is encrypted using AES-256-CBC + RSA-4096 algorithms and sent in the form of a verification request to the site litellm.dev, created by the attackers. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"