LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the
The popular Python package LiteLLM has been compromised in a supply chain attack, delivering a credential stealer and a backdoor. The malicious release, distributed through PyPI wheels and Docker images, affects LiteLLM version 1.107.0. LiteLLM's director of security, Oliver Jensen, stated that the compromise was traced back to three engineers' GitHub accounts, which were accessed using stolen GitHub CLI OAuth tokens.
The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. All involved tokens have been revoked, and the malicious wheels have been quarantined on PyPI and removed from Docker images. The malware, equipped to collect cloud credentials, private keys, browser data, and authentication files for AI development tools, is launched by Python before LiteLLM is imported through a path file (cook.pth).
The collected data is packaged into a GZIP-compressed TAR archive and sent to litellm.dev/healthcheck via an HTTP POST request.
Brief written by urgent.news from The Hacker News's own syndicated text. Machine-written — may contain errors; check the original before relying on it.
