title: LiteLLM 1.107.0 Payload Files Written to Python site-packages
id: 0d9b6c2e-3a41-4f7e-8b15-6e2c9d4a1f70
status: experimental
description: cook.pth / cook.py written into site-packages or dist-packages, or the privcollect marker / loader lock created (LiteLLM 1.107.0 supply-chain malware).
references:
    - https://docs.litellm.ai/blog/security-incident-oct-21-2026
author: Cybaverse
date: 2026-10-21
tags:
    - attack.persistence
    - attack.t1546.018
    - attack.t1195.001
logsource:
    category: file_event
    product: linux
detection:
    selection_pth:
        TargetFilename|contains:
            - '/site-packages/'
            - '/dist-packages/'
        TargetFilename|endswith:
            - '/cook.pth'
            - '/cook.py'
    selection_markers:
        TargetFilename:
            - '/tmp/.pc_once_72129118c59f5636c0bb'
            - '/tmp/remote_code_loader.lock'
    condition: 1 of selection_*
falsepositives:
    - Unlikely; no legitimate package is known to install a top-level cook.pth
level: critical