LiteLLM PyPI Compromise Delivers Credential-Stealing Startup Hooks
Attackers published a trojanized version of the widely-used LiteLLM package to PyPI, embedding malicious Python startup hooks that execute automatically at interpreter launch — meaning every Python process on an affected machine runs the payload, not just code that explicitly imports LiteLLM. The malware harvests credentials from cloud environments, browsers, SSH keys, and developer tools across Windows and macOS, dramatically broadening the blast radius beyond the intended application. This incident underscores how implicit trust in public package registries can transform a single compromised dependency into a full credential compromise across an entire developer environment. Because Python startup hooks persist independently of the package itself, simply uninstalling LiteLLM does not remediate the threat, making thorough forensic investigation and credential rotation mandatory.
Tactical Insight
Immediate actions
- Audit all Python environments for the presence of LiteLLM 1.107.0 and inspect `sitecustomize.py`, `usercustomize.py`, and `PYTHONSTARTUP` hooks for unauthorized modifications.
- Rotate all credentials (cloud API keys, SSH keys, browser-stored secrets, database passwords) on any system where the compromised package was installed.
- Terminate and investigate suspicious processes spawned from Python interpreters on affected hosts.
Long-term improvements
- Enforce the use of a private package mirror or artifact repository (e.g., Artifactory, AWS CodeArtifact) with allowlisting of approved package versions before they reach developer machines.
- Implement cryptographic hash pinning (e.g., `requirements.txt` with `--hash` flags) and integrate automated integrity verification into CI/CD pipelines for all third-party dependencies.
- Adopt a software composition analysis (SCA) tool that continuously monitors published packages for version anomalies, unexpected maintainer changes, or known malicious indicators.
Detection measures
- Deploy endpoint detection rules to alert on unexpected modifications to Python startup files (`sitecustomize.py`, `PYTHONSTARTUP` environment variable) and unauthorized network egress from Python interpreter processes.
- Monitor cloud credential usage logs for anomalous API calls or access from unfamiliar IP addresses following any package installation events.