Compromised LiteLLM Release Distributed Credential Stealer and Backdoor

Summary

LiteLLM 1.107.0 was compromised via PyPI and Docker, delivering malware that steals credentials and can run attacker-supplied Python. LiteLLM revoked involved tokens and advises affected users to rotate credentials and pin version 1.106.2 by digest.

Key points

The compromise affected LiteLLM 1.107.0 distributed through PyPI wheels and Docker images; PyPI quarantined the package and the malicious images were removed.
LiteLLM said the attacker used three engineers’ GitHub accounts, apparently via stolen GitHub CLI OAuth tokens, to trigger and approve a release. The tokens have been revoked; the original token-theft mechanism remains unknown.
A cook.pth file runs code when Python starts, launching the privcollect credential stealer before LiteLLM is imported.
The malware targets cloud tokens, private keys, developer accounts, AI-tool credential files, browser data, environment variables, and LiteLLM proxy credentials and model configuration.
A second payload checks a GitHub dead drop hourly and runs attacker-supplied Python; the cited repository, github[.]com/letters9813, currently returns a 404 error.
Collected data is sent in a GZIP-compressed TAR archive to litellm[.]dev/healthcheck.
Affected users are advised to revoke and replace exposed credentials from a clean environment and pin LiteLLM 1.106.2 by digest.

Article Details

Event Type: Software supply-chain compromise involving a malicious LiteLLM package release and Docker images.
Impact: LiteLLM 1.107.0 contained a credential stealer and a backdoor. The malware could collect cloud credentials, private keys, developer and AI-tool authentication data, browser data, environment variables, and LiteLLM proxy credentials and model configuration, then transmit collected data to a specified endpoint. LiteLLM said the malicious release was published using three engineers' GitHub accounts, apparently through stolen GitHub CLI OAuth tokens; the investigation into how the tokens were acquired was ongoing.

People

Oliver JensenLiteLLM's director of security, who described the investigation and the use of engineers' GitHub accounts to publish the malicious release.

Malware

privcollect"The first payload is a credential stealer that calls itself privcollect," StepSecurity said. "The second payload forks a background daemon that checks a GitHub dead drop every hour and runs whatever Python the attacker

Products

Industries

SoftwareThe popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.