Inside the LiteLLM 1.107.0 Supply Chain Compromise: Credential Theft Through Python Startup Hooks

On October 21, 2026, a significant supply chain attack targeted the LiteLLM library, resulting in a compromised release (v1.107.0) published to PyPI. Unlike typical malicious packages, this version contained hidden Python startup files that executed automatically upon the initialization of the Python interpreter, regardless of whether the LiteLLM library was actively imported.

Technical analysis revealed that the malicious code, dubbed ‘PRIVCOLLECT,’ operated as a credential harvester. By leveraging .pth and sitecustomize.py files, the attacker gained persistence and the ability to scan for sensitive data, including developer credentials, cloud environment keys, browser history, and SSH material. Collected data was encrypted using AES-256-CBC and exfiltrated to attacker-controlled endpoints. On Unix systems, the package included a secondary loader capable of fetching and executing arbitrary remote code, providing the attacker with a persistent re-armable backdoor.

Investigations by Microsoft suggest that stolen GitHub developer credentials were used to subvert the LiteLLM release workflow. This compromise highlights a critical risk: simply having the package installed on developer workstations, CI/CD agents, or containers was enough to trigger the malicious payload.

Organizations are urged to move beyond simple package deletion. Remediation must include:

1. Identifying and containing all affected environments (including caches and build artifacts).
2. Performing investigation using trusted, external tools rather than running Python inside suspected environments.
3. Rotating all credentials potentially exposed by the compromised identity, including model-provider keys and cloud secrets.
4. Implementing robust dependency controls, such as hash-pinned lock files and container image digests, to prevent the use of untrusted or tampered packages.

For ongoing defense, Microsoft provides specific detection signatures via Microsoft Defender and advanced hunting queries to identify suspicious network activity or file presence associated with this campaign.