GCVE-110-OSM-2026-14014

Docker image docker.io/litellm/litellm tags v1.107.0, latest, main-latest and main-stable resolve to an infected build of litellm 1.107.0 that includes the cook.pth/cook.py/sitecustomize.py credential stealer and remote-code loader. The image was built from a lookalike repository (Berri-AI/litellm) by the official release pipeline. Malicious payload found in: app/.venv/lib/python3.13/site-packages/cook.pth, cook.py, sitecustomize.py (byte-identical to the PyPI wheels) Infected index digest: sha256:1bbcb1443bc9… GHCR litellm:v1.107.0 amd64 manifest: sha256:bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5 arm64 manifest: sha256:56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf Exfil: POST http://www.litellm.dev/healthcheck (AES-256-CBC, RSA-4096-OAEP wrapped key) Dead-drop loader: https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt then GET http://<domain>/codepy exec() With DATABASE_URL set, dumps LiteLLM_CredentialsTable and LiteLLM_ProxyModelTable on first start. SLSA provenance: builder BerriAI/project-releaser run 39587059944, source github.com/Berri-AI/litellm @ 20535d8fa11f786a6c24df7488a0e449ed5f09ad