CriticalSupply chainBLWK-ROOTKIT-002

Traces of the LiteLLM 1.107.0 credential stealer were found

What this means

Found a trace of the poisoned LiteLLM 1.107.0 package (‹indicator› at ‹path›). That release stole cloud, AI, SSH and browser credentials and installed a backdoor. A lock file in /tmp means the backdoor ran; a .pc_once_ file means the theft already happened.

How to fix it

Treat this computer as compromised and change your credentials from a different, clean device.

1. Disconnect this computer from the network.
2. From another device, rotate cloud keys, CI tokens, AI API keys and SSH keys, starting with the most powerful.
3. Uninstall litellm 1.107.0 everywhere (the last safe version is 1.106.2) and delete cook.pth, cook.py and the sitecustomize.py it added.
4. Rebuild affected Python environments from pinned, verified packages.

Check it yourself

Run a scan and look for BLWK-ROOTKIT-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads supply_chain_iocs and reports this check when:

indicator in ["litellm_loader_lock", "litellm_exfil_marker", "litellm_cook_pth"]

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1195.001
• MITRE ATT&CK T1552.001

Related checks

• A Python startup hook runs code in every Python process · BLWK-PERSIST-005
• An MCP server runs an unpinned package from a registry · BLWK-AI-003
• An MCP server uses mcp-remote (critical command-injection ≤ 0.1.15) · BLWK-AI-004
• An MCP server launches via a shell interpreter · BLWK-AI-005
• An MCP server runs a privileged or host-mounting container · BLWK-AI-019