LiteLLM 1.107.0 was compromised: check your Python environments for stolen keys

# Check what is installed from a CLEAN machine, or read the files directly.
# Do not run pip in an environment you think is compromised.
cat .venv/lib/python*/site-packages/litellm-*.dist-info/METADATA | grep -i '^Version:'

# Pin a known-good version everywhere
grep -rn 'litellm' requirements*.txt pyproject.toml poetry.lock uv.lock 2>/dev/null
# then: litellm==1.106.4  (backports: 1.105.5, 1.104.7, 1.103.9)

# Node 18+; no dependencies, reads files only. Do NOT run python/pip here.
node litellm-scan.mjs                 # search under the current folder
node litellm-scan.mjs .venv           # or point it at a venv / environment
# exit 1 = indicators found, 0 = none in what was scanned

#!/usr/bin/env node
// litellm-scan.mjs: DETECT-ONLY scanner for the compromised LiteLLM 1.107.0
// release, which ran credential-stealing code at Python startup. It reads
// files only — it never imports anything, runs pip, or changes the
// environment, so it is safe to run against a suspect machine.
//
// IMPORTANT: do not run python or pip inside an environment you think is
// compromised — startup hooks fire the moment the interpreter loads. This
// scanner is plain Node and touches nothing but the filesystem.
//
//   node litellm-scan.mjs                       # search under the current dir
//   node litellm-scan.mjs /path/to/venv         # or point it at a venv/env
//
// What it looks for inside any site-packages it finds:
//   1. litellm installed at version 1.107.0 (the compromised release).
//   2. The startup-execution droppers: cook.pth, cook.py, sitecustomize.py.
//   3. Any .pth file that runs code on startup (a .pth line beginning with
//      "import" executes) or references the exfiltration host.
import fs from "node:fs";
import path from "node:path";
import { createHash } from "node:crypto";
import { pathToFileURL } from "node:url";

const BAD_LITELLM = new Set(["1.107.0"]);
const DROPPERS = new Set(["cook.pth", "cook.py", "sitecustomize.py"]);
// Published SHA-256 of the Linux/macOS droppers (StepSecurity). An exact match
// is definitive; Windows builds differ only by CRLF, so content checks also run.
const KNOWN_HASHES = new Set([
  "7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb", // cook.pth
  "9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25", // cook.py
  "34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa", // sitecustomize.py
]);
// Markers reported from the campaign; matching one in a .pth/.py is damning.
// The exfil POST goes to http://www.litellm.dev/healthcheck.
const EXFIL = /litellm\.dev\/healthcheck|PRIVCOLLECT_ACTIVE|remote_code_loader|import cook/i;
const PTH_EXEC = /^\s*import\s|\bexec\(|\bos\.system\(|subprocess/;

/** SHA-256 of a file, or "" if it cannot be read. */
function sha256(file) {
  try {
    return createHash("sha256").update(fs.readFileSync(file)).digest("hex");
  } catch {
    return "";
  }
}

const findings = [];
const alert = (msg) => findings.push({ level: "alert", msg });
const review = (msg) => findings.push({ level: "review", msg });

/** Reads a small text file without throwing. */
function readText(file) {
  try {
    return fs.readFileSync(file, "utf8");
  } catch {
    return "";
  }
}

/** Reads a litellm *.dist-info/METADATA version, if present in a site-packages. */
function checkLitellmVersion(sitePackages) {
  let entries;
  try {
    entries = fs.readdirSync(sitePackages, { withFileTypes: true });
  } catch {
    return;
  }
  for (const e of entries) {
    if (!e.isDirectory() || !/^litellm-.*\.dist-info$/i.test(e.name)) continue;
    const meta = readText(path.join(sitePackages, e.name, "METADATA"));
    const version = /^Version:\s*(.+)$/im.exec(meta)?.[1]?.trim();
    if (version && BAD_LITELLM.has(version)) alert(`${sitePackages}: litellm ${version} installed (compromised release)`);
    else if (version) review(`${sitePackages}: litellm ${version} installed — confirm it is not a compromised build`);
  }
}

/** Inspects one site-packages directory for droppers and executable .pth files. */
function checkSitePackages(dir) {
  checkLitellmVersion(dir);
  let entries;
  try {
    entries = fs.readdirSync(dir, { withFileTypes: true });
  } catch {
    return;
  }
  for (const e of entries) {
    if (!e.isFile()) continue;
    const file = path.join(dir, e.name);
    if (DROPPERS.has(e.name)) {
      if (KNOWN_HASHES.has(sha256(file))) {
        alert(`${file}: ${e.name} matches a known compromised hash`);
        continue;
      }
      const body = readText(file);
      const hot = EXFIL.test(body) || PTH_EXEC.test(body);
      (hot ? alert : review)(`${file}: ${e.name} present${hot ? " and runs/exfiltrates on startup" : " — review its contents"}`);
      continue;
    }
    if (e.name.endsWith(".pth")) {
      const body = readText(file);
      if (body.split(/\r?\n/).some((l) => PTH_EXEC.test(l)) || EXFIL.test(body)) {
        alert(`${file}: .pth file executes code on interpreter startup`);
      }
    }
  }
}

/** Walks a tree (bounded) and inspects every directory named site-packages. */
function walk(root, depth = 0) {
  if (depth > 8) return;
  let entries;
  try {
    entries = fs.readdirSync(root, { withFileTypes: true });
  } catch {
    return;
  }
  for (const e of entries) {
    if (!e.isDirectory()) continue;
    const dir = path.join(root, e.name);
    if (e.name === "site-packages") {
      checkSitePackages(dir);
      continue; // no need to recurse further into installed packages
    }
    if (e.name === ".git" || e.name === "node_modules") continue;
    walk(dir, depth + 1);
  }
}

function main(argv) {
  const root = path.resolve(argv[0] ?? ".");
  console.log(`litellm-scan — detect only, nothing is changed\nscanning: ${root}\n`);
  walk(root);

  const alerts = findings.filter((f) => f.level === "alert");
  const reviews = findings.filter((f) => f.level === "review");
  if (alerts.length) {
    console.log("INDICATORS FOUND — treat the environment as compromised:");
    for (const f of alerts) console.log(`  [!] ${f.msg}`);
    console.log(
      "\nDo NOT run python/pip here. Rebuild the environment from a clean base,\n" +
        "and rotate every credential it could reach (cloud keys, model-provider\n" +
        "keys, database URLs, tokens in its environment variables).",
    );
  }
  if (reviews.length) {
    console.log("\nWorth a look (not proof on their own):");
    for (const f of reviews) console.log(`  [?] ${f.msg}`);
  }
  if (!alerts.length && !reviews.length) {
    console.log("No indicators of the LiteLLM 1.107.0 compromise found in what was scanned.");
    console.log("This is not a guarantee — scan every machine, container and CI runner that installed LiteLLM.");
  }
  return alerts.length ? 1 : 0;
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  process.exitCode = main(process.argv.slice(2));
}