Hijacked LiteLLM release on PyPI and Docker planted a credential stealer and backdoor

CCybersecurity #AI-infrastructure #credential-theft #docker #litellm #pypi #python #supply-chain-attack

Hijacked LiteLLM release on PyPI and Docker planted a credential stealer and backdoor

SafeDep shows exactly how the malicious files got into the package; BleepingComputer lists the affected images and what to rotate.

Version 1.107.0 of LiteLLM, a popular open-source Python gateway for calling AI models, was published to PyPI and Docker registries with malware on October 21, according to SafeDep and BleepingComputer. LiteLLM confirmed the compromise and says the release pipeline was hijacked; SafeDep says LiteLLM believes the attacker took three developers' GitHub CLI credentials from the logs of an internet-exposed internal deployment.

All seven wheels for Linux, macOS and Windows added three files that run whenever Python starts, even if litellm is never imported. One steals SSH keys, cloud and CI/CD credentials, AI tool tokens, browser passwords and stored model-provider keys; another checks in hourly and downloads and runs more code. The PyPI release was live from 11:39 to 13:23 UTC; Docker Hub and GHCR tags pointed to bad images for a couple of hours. Versions 1.106.2 and the 1.107.0 release candidates are clean.

BleepingComputer says affected systems should be isolated and rebuilt and all exposed secrets rotated, and warns that running Python or pip to investigate also triggers the malware.

Read it at the source

SafeDepCompromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor Independent ↗ BleepingComputerLiteLLM release pipeline hacked to distribute info-stealer malware Independent ↗

Cascadic Analysis 1

UndertowPrivilege escalation + credential propagation

What hidden risk could pull against this, even if the news is good?

SafeDep says LiteLLM believes the attacker started with three developers' GitHub CLI credentials, found in the logs of an internet-exposed internal deployment. Those let the attacker publish a release, and the release's job was to collect more credentials: SSH keys, cloud and CI/CD secrets, AI tool tokens and stored model-provider keys. Because LiteLLM is a gateway that sits in front of many model providers, the machines that run it tend to hold keys to all of them at once.

Rabbit Holes 2

Supply chain attack

After exploring Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor, the wider pattern is described in Supply chain attack.

An overview of cyberattacks that target less secure links in a supply chain, typically by tampering with the manufacture or distribution of a product.

Wikipedia · Wade · 5 min

0
SLSA • Supply-chain Levels for Software Artifacts

After exploring LiteLLM release pipeline hacked to distribute info-stealer malware, one industry answer to poisoned releases is SLSA • Supply-chain Levels for Software Artifacts.

The SLSA framework: a set of incremental security guidelines for protecting the integrity of software builds and releases.

OpenSSF / SLSA · Plunge · an evening

0

Hijacked LiteLLM release on PyPI and Docker planted a credential stealer and backdoor

Further down the stream