Search — “sitecustomize.py”

Attackers used a leaked, unrevoked LiteLLM Agent Platform master key to steal GitHub OAuth tokens, harvest CI secrets via throwaway-branch workflows exfiltrating to webhook.site, and repoint the release pipeline to a lookalike repo, publishing malicious LiteLLM 1.107.0 to PyPI, Docker Hub and GHCR on 2026-10-21. The wheel drops cook.pth/cook.py/sitecustomize.py into site-packages so any Python start runs the PRIVCOLLECT credential collector, which encrypts loot with OpenSSL in .pc_e_ staging dirs and POSTs to www.litellm.dev/healthcheck; a Unix loader polls a GitHub dead-drop for second-stage code (not confirmed executed). Microsoft observed collector activity on Windows and macOS endpoints. Hunt for Python spawning systeminfo/ipconfig/openssl, connections to litellm.dev, the startup files outside the litellm directory, and /tmp marker/lock files.

Attackers used stolen GitHub CLI OAuth tokens (suspected leaked via an exposed internal LiteLLM deployment's logs) to hijack LiteLLM's release workflow and publish 1.107.0 to PyPI, Docker Hub and GHCR. A cook.pth file runs a 'privcollect' stealer at Python startup, exfiltrating a tar.gz via HTTP POST to litellm[.]dev/healthcheck, while sitecustomize.py forks a daemon (lock /tmp/remote_code_loader.lock) that hourly fetches a C2 domain from a GitHub dead drop and executes <domain>/codepy. Stolen AWS role credentials were validated ~4.5h later with sts:GetCallerIdentity and Bedrock calls (LLMjacking). Hunt for cook.pth/sitecustomize.py in site-packages, the lock file, connections to litellm[.]dev, and CloudTrail activity from the listed IPs.