---
title: Hunt: LiteLLM 1.107.0 startup-hook backdoor: cook.pth, sitecustomize.py, /tmp lock files and calls to litellm[.]dev | ctxsec
url: https://ctxsec.com/items/hunt-litellm-1-107-0-cook-pth-iocs
description: ""
status: "IOCs from JFrog, StepSecurity and AISLE research, last updated Oct 25, 2026, 8:10 PM ET"
published: 2026-10-21
updated: 2026-10-25T20:10:00-04:00
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-litellm-1-107-0-cook-pth-iocs.md)

IOCs from JFrog, StepSecurity and AISLE research

2026-10-21 · updated

Oct 25, 2026, 8:10 PM ET

### Hunt: LiteLLM 1.107.0 startup-hook backdoor: cook.pth, sitecustomize.py, /tmp lock files and calls to litellm[.]dev

**Update Oct 25:** Microsoft published Defender XDR advanced hunting queries (connections to `www.litellm[.]dev`, the six startup-file SHA-256 hashes, OpenSSL runs using `.pc_e_` staging dirs, and an inline Python query against the `LiteLLM_CredentialsTable`/`LiteLLM_ProxyModelTable` tables) plus the marker file `/tmp/.pc_once_72129118c59f5636c0bb`, written after a successful upload. Investigate from a clean machine: running python or pip in the affected environment can set off the collector. On the GitHub side, LiteLLM's root-cause analysis lists IPs `69.48.229.143` and `199.91.221.39`, the lookalike org `Berri-AI`, and branches named like `ci-tmp-*` whose workflows posted secrets to webhook.site. If your org was forked by or interacted with these, check your own audit log.

For the [LiteLLM 1.107.0 compromise](/news#litellm-1-107-0-pypi-docker-backdoored-wheels):

1. **Files:** any `site-packages/cook.pth`, `cook.py` or an unexpected `sitecustomize.py` (plus their `__pycache__` copies), in venvs, containers and CI caches. `cook.pth` contains only `import cook`.
2. **Markers:** `/tmp/.pc_once_72129118c59f5636c0bb`, `/tmp/remote_code_loader.lock`, `/tmp/.pc_sq_*`, `/tmp/.pc_e_*`.
3. **Processes:** detached Python processes started via `setsid` with working directory `/`, or holding the loader lock.
4. **Network:** DNS or proxy hits for `www.litellm[.]dev` / `litellm[.]dev` (POST `/healthcheck`, header `X-Token: XWiA8gZNa7NcX2XRoAEb`, old IE user agent), hourly requests to `raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt`, then `http://<domain>/codepy`. Also look for reads of `169.254.169.254` from Python on hosts that shouldn't need it.
5. **CI:** any runner job that installed litellm 1.107.0 or ran its image: StepSecurity notes the stealer reads `/proc/<pid>/environ` of every process, so treat every secret in that job as stolen.

Clean up with tools that don't start the affected interpreter, preserve proxy/DNS/EDR and cloud audit logs first, then rotate.

Sources: [Microsoft Security Blog: Inside the LiteLLM 1.107.0 supply chain compromise (Oct 23)](https://www.microsoft.com/en-us/security/blog/2026/10/23/inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks/) · [LiteLLM: The attack chain behind the v1.107.0 LiteLLM release (root-cause analysis, Oct 23)](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain) · [JFrog research](https://research.jfrog.com/post/litellm-hijacked-again/) · [AISLE research](https://aisle.com/blog/litellm-11070-on-pypi-shipped-a-credential-stealer) · [StepSecurity research](https://www.stepsecurity.io/blog/litellm-1-107-0-compromised-pypi-backdoored-wheels-credential-stealer)