LiteLLM supply chain attack hoovers up passwords and secrets
Plus a RAT for good measure - get threat hunting now
On Wednesday, cybercriminals infiltrated the release process of LiteLLM, a popular open-source AI gateway, distributing a malicious version (1.107.0) tainted with malware. This malicious package was designed to pilfer cloud and AI credentials, as well as to execute arbitrary code on affected machines through PyPI and Docker registries.
PyPI swiftly isolated the infected version, and the Docker image was promptly removed from Docker Hub and GHCR. However, any user who had executed the compromised package across various platforms should assume that their secrets have been stolen. To detect potential compromise, experts advise looking for specific files such as /tmp/.pc_once_* and /tmp/remote_code_loader.lock.
The most recent and secure version of LiteLLM is v1.106.2. While the extent of this attack remains unclear, it is crucial to take these precautions seriously and check for indicators of compromise. Aikido Security, Google's Wiz cloud security firm, and supply-chain security provider Socket have all released comprehensive threat-hunting and mitigation guidelines for LiteLLM users and security teams.
LiteLLM, developed by BerriAI, offers a unified interface for LLM providers, including OpenAI, Anthropic, and Google Gemini, and boasts approximately 23 million weekly downloads. Consequently, a compromised installation can inadvertently expose a wealth of sensitive credentials, secrets, and other valuable data to the attacker. The malicious version was uploaded to the repository at 11:39 UTC, originating from malicious commits made on the GitHub repository github.com/Berri-AI/litellm, a hyphenated variant of the legitimate BerriAI organization.
These malicious files, including cook.pth, cook.py, and sitecustomize.py, infiltrate the LiteLLM release pipeline, executing various modules that harvest sensitive information from browsers, cloud providers, AI services, and more. This data is subsequently encrypted and sent to an attacker-controlled domain, posing a significant threat to LiteLLM users worldwide.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
Also reported by 1 other outlet
- LiteLLM supply chain attack hoovers up passwords and secrets theregister.com
