[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFC-poXeS-6ULpBUBPp9Y9_BV5ypv9xlYRw-WmofHERE":3},{"article":4,"iocs":56,"watch_terms":60,"solutions":61,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"40242e1d-6e2d-4dd1-9f2e-84ba28d5ebe1","Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks","inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-pyth-e59453","Microsoft Threat Intelligence analyzes the LiteLLM 1.107.0 compromise, including Python startup hooks, credential theft, remote code loading, detections, and mitigations. The post Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks appeared first on Microsoft Security Blog.","On October 21, 2026, a compromised LiteLLM 1.107.0 release was published to PyPI with malicious startup hooks that execute automatically when Python starts, regardless of whether the application uses LiteLLM. The payload collects credentials from developer tools, cloud environments, browsers, SSH keys, and LiteLLM proxy databases across Windows and macOS systems. Microsoft Threat Intelligence warns that simply removing the package is insufficient recovery; organizations must audit affected Python environments, terminate suspicious processes, and rotate all exposed credentials.","LiteLLM 1.107.0 PyPI package compromised with credential-stealing malware via Python startup hooks","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F10\u002F23\u002Finside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FMS_Actional-Insights_Links.jpg","2026-10-23T18:12:19+00:00","2026-10-23T20:00:16.767104+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":22},"Python Package Index (PyPI)","technology",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":22},"Python startup hooks",{"name":29,"type":19},"Microsoft Defender","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":45,"value":58,"context":59},"LiteLLM 1.107.0 credential collector","Malicious payload embedded in compromised PyPI package that harvests credentials on Python startup",[24,18,29],{"controls":62,"vendors":142},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,104,112],{"vendor_slug":98,"vendor_name":24,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":121,"name":122,"problem":123,"products":124},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[125,126,134],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[143],{"slug":98,"name":24,"logo_path":99,"roles":144},[145],"reported_by",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":158},"litellm-pypi-compromise-delivers-credential-stealing-startup-hooks","LiteLLM PyPI Compromise Delivers Credential-Stealing Startup Hooks","Attackers published a trojanized version of the widely-used LiteLLM package to PyPI, embedding malicious Python startup hooks that execute automatically at interpreter launch — meaning every Python process on an affected machine runs the payload, not just code that explicitly imports LiteLLM. The malware harvests credentials from cloud environments, browsers, SSH keys, and developer tools across Windows and macOS, dramatically broadening the blast radius beyond the intended application. This incident underscores how implicit trust in public package registries can transform a single compromised dependency into a full credential compromise across an entire developer environment. Because Python startup hooks persist independently of the package itself, simply uninstalling LiteLLM does not remediate the threat, making thorough forensic investigation and credential rotation mandatory.",[151,152,153,154,155,156,157],"CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 7: Continuous Vulnerability Management",{"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 17: Incident Response Management":160,"OWASP A06:2021 Vulnerable and Outdated Components":161,"CIS Control 7: Continuous Vulnerability Management":162,"CIS Control 2: Inventory and Control of Software Assets":163,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":164,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":165},"SI-2 requires organizations to identify, report, and remediate software flaws — including malicious code introduced through third-party packages — in a timely and structured manner, directly addressing the need for rapid response to this trojanized release.","Microsoft's guidance that simple package removal is insufficient highlights the need for a formal IR process covering forensic scoping, credential rotation, and persistence mechanism removal — all core IR management requirements.","This category explicitly covers risks from unverified or compromised third-party components; enforcing dependency integrity checks and using a vetted package registry would have intercepted the malicious LiteLLM build.","Continuous vulnerability management — including scanning for known-bad package versions and anomalous dependency changes — would have detected the malicious LiteLLM release before it was deployed across developer environments.","Maintaining an approved software inventory with verified versions would have flagged the unexpected publication of LiteLLM 1.107.0 and prevented its installation on developer machines.","This control requires organizations to identify and remediate technical vulnerabilities in software they use, which extends to monitoring public package registries for compromised releases and acting swiftly when one is identified.","Because the malware harvested credentials from multiple sources, strong secrets management practices — such as short-lived tokens and hardware-backed credentials — would have limited the value of the stolen material."]