GCVE-110-OSM-2026-14000

UPDATED October 20, 2026: LiteLLM 1.107.0 contains a credential stealer and persistent Python backdoor. The analyzed wheel uses cook.pth and sitecustomize.py to execute automatically whenever Python initializes, without requiring an explicit LiteLLM import. It collects browser passwords, cloud and container credentials, environment variables, private keys, CI/CD secrets, developer-tool credentials, and LiteLLM database records. Collected data is encrypted and sent to http://www.litellm.dev/healthcheck. A separate daemon retrieves a mutable C2 hostname from a GitHub-hosted domain.txt file, downloads Python from http://{domain}/codepy, executes it, and polls hourly. The remote /codepy stage was unavailable, so downstream behavior remains unresolved. March 2026: TeamPCP trojanized the LiteLLM PyPI package, publishing malicious versions 1.82.7 and 1.82.8 on March 24, 2026 around 08:30 UTC before PyPI quarantined them roughly three hours later. LiteLLM is a widely deployed Python library and proxy server reportedly present in 36% of cloud environments, making this a high-impact supply chain attack. The compromise is the latest stage of an ongoing TeamPCP campaign that has previously trojanized Trivy and Checkmarx KICS, and the root cause traces back to PyPI maintainer credentials stolen during the earlier Trivy incident, which the attackers reused to publish backdoored LiteLLM releases under the legitimate maintainer's identity October 20, 2026 payload details: The wheel contains cook.pth, cook.py, and sitecustomize.py as recorded members of the wheel's RECORD manifest. cook.pth contains `import cook`, causing cook.py to load during Python site initialization. cook.py Base64-decodes and zlib-decompresses an embedded 1,237-line Python credential collector and executes it with exec(). The cook variant runs asynchronously, sets PRIVCOLLECT_ACTIVE=1, and writes /tmp/.pc_once_72129118c59f5636c0bb after a successful upload. The collector targets Chromium and Firefox credentials, cookies and history; SSH, GPG and TLS private keys; shell and database histories; AWS, Azure, GCP, Kubernetes and Docker credentials; package-registry and CI/CD secrets; AI-development-tool credentials; .env files; current and readable /proc/*/environ values; cloud metadata credentials; and LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable records. Results are serialized to JSON, encrypted using AES-256-CBC with a random key and IV, and packaged into a gzip tar containing hdr.json, data.bin and key.bin. The AES key is encrypted with an embedded RSA public key using OAEP. The archive is POSTed over plain HTTP to http://www.litellm.dev/healthcheck with X-Token: XWiA8gZNa7NcX2XRoAEb, X-SHA256, and a hard-coded Internet Explorer-style User-Agent. sitecustomize.py creates /tmp/remote_code_loader.lock, forks, calls setsid(), redirects standard streams to /dev/null, changes directory to /, and enters an hourly loop. It retrieves https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt, validates and resolves the supplied hostname, downloads http://{domain}/codepy, and executes the response using exec(compile(code, '<remote>', 'exec'), {'__name__': '__main__'}). March 2026 payload details: Payload: litellm_init.pth Version 1.82.7 dropped a base64-encoded p.py file to disk that executed when users ran litellm --proxy or imported litellm.proxy.proxy_server. Version 1.82.8 escalated persistence by installing a litellm_init.pth file that abuses Python's .pth auto-execution mechanism to run a double-base64-encoded subprocess payload on every Python interpreter startup system-wide, regardless of whether LiteLLM is imported. The payload performs broad credential harvesting targeting environment variables, SSH keys, AWS/GCP/Azure cloud credentials, Kubernetes configs, CI/CD secrets, Docker configs, database credentials, and cryptocurrency wallets. Stolen data is encrypted with AES-256, the symmetric key is wrapped with an embedded RSA public key, and the bundle is exfiltrated to checkmarx[.]zone (v1.82.7) and models[.]litellm[.]cloud (v1.82.8). IOCs: - ipv4: 168.63.129.16, 1.24.3.1, 2.3.5.6, 4.5.8.9, 1.1.1.1 (+3 more) - urls: models.litellm.cloud, litellm.cloud, checkmarx.zone - urls: https://checkmarx.zone/raw - ips: 46.151.182.203 - sha256Hashes: 2796ee9483c3fd7aa2e171d38f4ca12251a30609463dcfd4cd76703f22e96cdf, 2a7f981751ec7fdf87b5b91ad4db53683a98082e9ff7bfd12c8cd5ea85980a52, 1c914d844307b0588599b8393480a3ba917b660c7e9dfae681542b5325f228db, 6282abe6a492de4145d7bb601023762212f9ddbbe78278bd6771c8b3b2f2a13b, c4c54e3c8c97cd50c2d2fec9be3b6065563ccf7d43787fb99f84151b867178fe (+10 more) - payloadFileHash: bd2c846c71b05d9147f51a5b42a51e300ea7319be5c6709e95b6d04094ada51f