LiteLLM: How to Detect & Remove cook.pth Supply Chain Backdoor

Executive Summary

On October 21, 2026, security researchers from SafeDep, Socket, StepSecurity, and Upwind disclosed a major software supply chain attack compromising LiteLLM, an open-source Python library and proxy server widely utilized by thousands of enterprises to interface with over 100 Large Language Model (LLM) APIs (including OpenAI, Anthropic, Google Vertex AI, AWS Bedrock, and Azure OpenAI).

The threat actor compromised version 1.107.0 across both Python Package Index (PyPI) pre-compiled binary wheels and official Docker container images. LiteLLM security leadership confirmed that adversaries hijacked three maintainers' GitHub accounts by obtaining stolen GitHub CLI OAuth tokens, leveraging one account to trigger the automated project-releaser workflow and a second maintainer account to sign off on the publication run.

The trojanized distribution deploys an automatic startup execution technique using a malicious path configuration file (`cook.pth`). The file invokes a credential stealer named `privcollect`, specifically targeting enterprise AI deployment secrets, LLM proxy routing databases, cloud tokens, and browser credentials, exfiltrating the archive to `litellm.dev/healthcheck`. Concurrently, a persistent background daemon polls a GitHub dead drop (`github.com/letters9813`) to execute arbitrary remote Python code.

PyPI quarantined the affected release and malicious Docker containers were removed. However, developer environments and automated CI/CD pipelines that pulled LiteLLM 1.107.0 must be treated as fully compromised.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

This intrusion illustrates how threat actors combine SaaS developer token theft with subtle Python interpreter startup mechanics to achieve pre-import stealth execution.

[ Adversary ]
     │
     │ 1. Uses Stolen GitHub CLI OAuth Tokens (3 Maintainer Accounts)
     ▼
[ GitHub Actions Pipeline: project-releaser ]
     │
     │ 2. Actor triggers release with account #1; approves release with account #2
     ▼
[ PyPI & Docker Hub Registries ]
     │
     │ 3. Publishes trojanized LiteLLM 1.107.0 (wheels + Docker images)
     ▼
[ Developer / CI/CD Machine: pip install litellm==1.107.0 ]
     │
     │ 4. Installs into site-packages: contains "cook.pth" (single line: "import cook")
     ▼
[ Python Interpreter Startup ]
     │
     │ 5. Auto-executes "import cook" BEFORE user code imports litellm!
     ├── Payload A: "privcollect" Credential Stealer
     │     ├── Scans ~/.aws, ~/.azure, ~/.config/gcloud
     │     ├── Steals OpenAI, Anthropic, Gemini API keys
     │     ├── Dumps LiteLLM proxy DB model configs & master keys
     │     └── POST to litellm.dev/healthcheck
     └── Payload B: Dead-Drop Backdoor Daemon
           └── Hourly poll: github.com/letters9813/domain.txt -> runs remote codepy

1. OAuth Token Theft & Release Pipeline Subversion

LiteLLM leverages automated GitHub Actions workflows to build and release binary wheels to PyPI. By acquiring stolen GitHub CLI OAuth tokens, the threat actors bypassed multi-factor authentication (MFA) prompts. The actor used one maintainer identity to initiate the release event and a second compromised maintainer identity to satisfy branch protection and release approval gates, enabling the release of unreviewed code directly into the PyPI supply chain.

2. The Python Path Configuration File (.pth) Execution Vector

Standard security linters examine setup.py or __init__.py for malicious commands. However, Python supports path configuration files (.pth) located inside site-packages.

• According to the Python documentation, any line in a .pth file starting with import is executed on interpreter startup.
• The malicious wheel introduced `cook.pth`, containing the single directive:

import cook

• As a result, any Python execution within the affected environment (even running python -c "print('hello')" or launching an unrelated test suite) automatically executes the payload before any application logic runs. This exact persistence mechanism was previously observed in the TeamPCP supply chain attacks in March 2026.

3. Dual Payload Mechanics: privcollect and Dead-Drop C2

• `privcollect` Stealer: Scans disk paths for cloud credentials (~/.aws/credentials, ~/.azure), browser cookies/passwords (Chrome, Firefox), environment variables (OPENAI_API_KEY, ANTHROPIC_API_KEY, COHERE_API_KEY), and SSH keys. Additionally, it reads LiteLLM's local SQLite and PostgreSQL proxy database configs to steal all stored end-user proxy API tokens and upstream model connection secrets. The data is compressed into a GZIP archive and sent to litellm.dev/healthcheck via HTTP POST.
• Dead-Drop Backdoor: Spawns a detached background process that polls a raw text file located at github.com/letters9813/domain.txt. When populated with an active domain, the daemon fetches http://<domain>/codepy and executes the downloaded string via Python's exec(), establishing dynamic remote command execution.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

---

Detection & SOC Mitigation Playbook

1. Concrete Remediation & Workarounds

DevOps and AI security engineers must execute the following remediation runbook across all developer workstations, CI/CD runners, and container clusters:

Step 1: Detect and Purge LiteLLM 1.107.0 and cook.pth

Inspect all active virtual environments and container deployments:

# 1. Search for rogue .pth files across Python site-packages
find / -name "cook.pth" 2>/dev/null
find ~/.local/ -name "cook.pth" 2>/dev/null

# 2. Inspect installed LiteLLM version
pip show litellm

# 3. If version 1.107.0 is detected, immediately purge:
pip uninstall -y litellm
# Manually remove rogue files if leftover
find / -name "*cook*" -path "*/site-packages/*" -delete 2>/dev/null

# 4. Pin to verified clean version 1.106.2
pip install litellm==1.106.2

Step 2: Terminate Rogue Python Daemons

Kill any background Python processes running the dead-drop polling loop:

# Search for running processes referencing cook or letters9813
pgrep -fa "python.*cook"
pgrep -fa "letters9813"

# Terminate rogue PIDs
sudo pkill -9 -f "cook"
sudo pkill -9 -f "letters9813"

Step 3: Mandatory Enterprise AI Secret Rotation

Because privcollect specifically harvested enterprise AI gateway credentials:

1. Invalidate and re-issue all OpenAI API keys, Anthropic API keys, Cohere keys, and HuggingFace tokens.
2. Rotate master proxy keys and salt secrets used in LiteLLM Proxy Server database instances.
3. Invalidate developer cloud credentials on machines where LiteLLM 1.107.0 was installed.

---

2. Network & Perimeter Defenses

1. Egress Firewall Filtering: Block network egress to adversary exfiltration infrastructure:

# Drop outbound connections to rogue healthcheck endpoint
sudo iptables -A OUTPUT -d litellm.dev -j DROP

1. Container Immutability: Deploy Docker containers with read-only root filesystems (--read-only) and disable interpreter auto-write capabilities in production environments.

---

3. Endpoint Detection & Hunting Query

Validated Sigma Rule (YAML)

Detects Python interpreter startup loading or creating .pth files containing suspicious execution strings:

title: Suspicious Python Path File Execution Hook
id: e4b28190-32a1-49fc-9102-54a8b7c3d211
status: test
description: Detects the creation or execution of Python .pth files designed to achieve automatic execution upon interpreter invocation.
references:
    - https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html?ref=cybernewsai.com
    - https://attack.mitre.org/techniques/T1546/016/
author: CyberNewsAI Threat Research Team
date: 2026/10/21
logsource:
    category: file_event
    product: linux
detection:
    selection_file:
        TargetFilename|endswith:
            - '/cook.pth'
            - '/site-packages/cook.pth'
    condition: selection_file
level: critical
tags:
    - attack.persistence
    - attack.t1546.016
    - attack.supply_chain

Microsoft Sentinel / Defender KQL Hunting Query

Search for network egress directed toward the adversary exfiltration endpoint and dead-drop repository:

// Query 1: Hunt for Network Connections to Exfiltration Endpoint
DeviceNetworkEvents
| where RemoteUrl has "litellm.dev/healthcheck" or RemoteUrl has "letters9813"
| project
    TimeGenerated,
    DeviceId,
    DeviceName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteIP,
    RemoteUrl
| order by TimeGenerated desc

// Query 2: Hunt for File Creation of cook.pth in Site-Packages
DeviceFileEvents
| where FileName =~ "cook.pth" or FileName =~ "cook.py"
| project
    TimeGenerated,
    DeviceId,
    DeviceName,
    InitiatingProcessFileName,
    FolderPath,
    FileName
| order by TimeGenerated desc

Splunk (SPL) Hunting Query

Search proxy and DNS logs for queries to the malicious exfiltration domain:

index=* (query="*litellm.dev*" OR url="*litellm.dev/healthcheck*" OR query="*letters9813*")
| stats count earliest(_time) as first_seen latest(_time) as last_seen values(src_ip) as affected_hosts by query, url
| convert ctime(first_seen) ctime(last_seen)
| sort - count

---

(Note: Authoritative advisories report package quarantining; hunt using behavioral file creation and network exfiltration indicators above.)