Popular LiteLLM library hacked, version with hidden malware released

LiteLLM version 1.107.0 was compromised in a supply chain attack utilizing stolen GitHub OAuth tokens. Attackers initiated and approved malicious releases containing credential-stealing malware and a backdoor. The affected installation wheels and mitigation steps should be reviewed. The issue is limited to version 1.107.0, which was distributed through official channels and ready-made application packages.

Project managers swiftly withdrew the affected material and removed related publications. The GitHub breach occurred after attackers used stolen digital keys to gain access to three engineering accounts on the GitHub code development platform. They used one account to trigger the release process and another to approve it. All compromised keys were immediately revoked by LiteLLM, and users were removed from the official project team as a precaution.

The company's security director, Oliver Jensen, stated that the investigation into the incident is ongoing. The malicious version contained two primary dangerous elements: a program that collects sensitive data, such as cloud service keys, private keys, browser data, and AI-related connection files; and a hidden background program that periodically checks a remote internet location for new code to retrieve and execute.

The malware is activated automatically upon program launch. Collected data is compressed and automatically sent to an external address via internet request. Affected users are advised to cancel and replace all compromised sensitive logins and keys using a clean device, roll back to a secure previous version of the software, and set G Hacks.gr as a preferred source for cybersecurity updates.