[carlospolop]

Blog URL

https://wiz.io/blog/litellm-compromised-steals-credentials

Blog Title

LiteLLM Compromised, Steals Credentials

Blog high summary

The post analyzes the October 21, 2026 LiteLLM 1.107.0 supply-chain compromise affecting PyPI wheels and GHCR/Docker images. Installing the release placed cook.pth, cook.py, and sitecustomize.py in site-packages; Python startup then ran a stealer targeting browser, cloud, AI, SSH/GPG, shell-history, and LiteLLM PostgreSQL secrets. (wiz.io)

Harvested data was AES-256-CBC/RSA-4096 wrapped and sent to a lookalike domain; Linux/macOS could also fetch and execute a second-stage /codepy. Stolen AWS roles were tested for Bedrock and IAM enumeration, enabling LLMjacking and further cloud abuse. The post identifies 1.106.2 as the latest safe release. (wiz.io)

PR changes

• src/pentesting-ci-cd/github-security/abusing-github-actions/README.md: Expanded the Python startup-hook section with dual-hook wheel packaging, startup constraints, and a link to the related PYTHONPATH technique.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The LiteLLM source diff confirms the Maturin data/purelib layout. The base page covered a .pth hook, but not this wheel-packaging detail. The Python site documentation supports the startup behavior; the [Wiz report]…

Head: c54b94d1c3be8d94dad40f745d046fe67f6c68cd

[carlospolop]

merge