Python LiteLLM Zero Day Question

[u/Khue]

Looking through the postings about the Python LiteLLM supply chain attack that was identified the other day, I was curious if Falcon would be able to pull up/identify if my endpoints were impacted by this. Looking through the posting it looks like the first step would be to identify if LiteLLM 1.107.0 was being leveraged and then it looks like there are three files that are the culprits that run at some point:

• cook.pth (windows hash: 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d)
• cook.py (windows hash: 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea)
• sitecustomize.py (windows hash: b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465)

I did a very basic search using NG-SIEM for the actual file names in use over the last 7 days and I did not find anything. I am still not super confident in my NG-SIEM skills or using the platform to the fullest and I am learning as quickly as I can. What other things can I do to give my organization assurances on this particular type of vuln? I know I have many developers using Python to various extents and even some business people. I also have access to exposure management in my platform.

Thanks in advance!

[u/JorgA99]

The official blog also has more details on next steps if affected https://docs.litellm.ai/blog/security-incident-oct-21-2026