LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind .
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind .
The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images.
The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed.
All tokens which were involved in this attack have been revoked. We have not yet identified the mechanism by which the threat actor acquired the relevant tokens, so cannot yet assert that no further access to these GitHub accounts.
As a temporary mitigation, we have removed all but one (unaffected) user from our GitHub organization." Separately, LiteLLM said it has updated the public registries to remove any trusted links to its GitHub organization so as to prevent further publication of malicious packages.
It's worth noting that the same behavior was observed in the LiteLLM compromise that took place as part of the TeamPCP supply chain attacks earlier this March .
"The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it.
Analysis of the malicious version shows that it's equipped to collect cloud credentials, private keys, browser data, and authentication files for AI development tools.
The malware is launched by Python even before LiteLLM is imported through a path file ( ), which is designed to automatically execute code when the interpreter starts.
In addition, the malware is designed to read the contents of a text file ( ) located within a GitHub repository ( ), check if it holds a domain and, if so, run the same stealer, and finally run an HTTP GET request against and execute the response.
The file contains a single line, which, in turn, launches the credential collector payload.
This includes harvesting cloud tokens, developer accounts and private keys, AI tooling credential JSON files, browser data associated with Chromium and Firefox, and environment variables.
The malware is also capable of targeting LiteLLM deployments with an aim to extract the proxy's saved credentials and model configuration.
Oliver Jensen, director of security at LiteLLM, said an investigation into the incident is ongoing, and that it's still working to trace the original attack vector by which the threat actor published the malicious release.
What happened
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind .
The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images.
The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed.
What changed
All tokens which were involved in this attack have been revoked. We have not yet identified the mechanism by which the threat actor acquired the relevant tokens, so cannot yet assert that no further access to these GitHub accounts.
As a temporary mitigation, we have removed all but one (unaffected) user from our GitHub organization." Separately, LiteLLM said it has updated the public registries to remove any trusted links to its GitHub organization so as to prevent further publication of malicious packages.
It's worth noting that the same behavior was observed in the LiteLLM compromise that took place as part of the TeamPCP supply chain attacks earlier this March .
Who is affected
"The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it.
Analysis of the malicious version shows that it's equipped to collect cloud credentials, private keys, browser data, and authentication files for AI development tools.
Why it matters
The malware is launched by Python even before LiteLLM is imported through a path file ( ), which is designed to automatically execute code when the interpreter starts.
In addition, the malware is designed to read the contents of a text file ( ) located within a GitHub repository ( ), check if it holds a domain and, if so, run the same stealer, and finally run an HTTP GET request against and execute the response.
Technical details
The file contains a single line, which, in turn, launches the credential collector payload.
This includes harvesting cloud tokens, developer accounts and private keys, AI tooling credential JSON files, browser data associated with Chromium and Firefox, and environment variables.
The malware is also capable of targeting LiteLLM deployments with an aim to extract the proxy's saved credentials and model configuration.
Response
Oliver Jensen, director of security at LiteLLM, said an investigation into the incident is ongoing, and that it's still working to trace the original attack vector by which the threat actor published the malicious release.
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
What security teams should do
Until you can install it, what lowers your risk is taking exposed PHP off the internet or behind access controls, cutting what a compromised server can reach, and having the update ready to apply the moment it lands.
Cloudflare says it is seeing early attempts to exploit the flaws, and has pushed emergency rules for sites behind it that it calls a stopgap until you patch.
What remains unknown
PHP has not said which versions are affected, which part of PHP is involved, or whether any setting changes the risk; it says the full details and the fixed versions come with the release.
GMO Flatt expects a way around it but has not said what that is.
Attribution
The Hacker News: The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep , Socket , StepSecurity , and Upwind .
The Hacker News: You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that suggested it now says.
Wiz Research: Wiz Research uncovered multiple critical vulnerabilities in core PHP, a popular general-purpose scripting language that powers 70% of all websites in the world.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.