Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
SHA256VerifiedSignal 68/100
7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d
Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
Found in 5 reports: litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader; LiteLLM Compromised, Steals Credentials; LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials · all 5 reports
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
83%
Signal Score
68 / 100
IDS Rule
Yes
Threat Context
Tags
Feed Intelligence Summary
5 reports83% confidence
Step Security
6d ago
litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
18 IOCs in report
Socket Security
6d ago
20 IOCs in report
OpenSourceMalware
6d ago
6 IOCs in report
Datadog Security Labs
Oct 21, 2026
9 IOCs in report
Activity Timeline
Threat Activity Heatmap
Related Reports
litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
Step Security18 IOC
LiteLLM Compromised, Steals Credentials
Wiz22 IOC
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials
Socket Security20 IOC
LiteLLM 1.107.0 PyPI Wheel Contains a Credential Stealer and Persistent Python Backdoor
OpenSourceMalware6 IOC
LiteLLM supply chain compromise: What you need to know
Datadog Security Labs9 IOC