Attackers Poison LiteLLM 1.107.0 Packages in Supply-Chain Attack
Summary
LiteLLM says attackers poisoned version 1.107.0 on PyPI and Docker for about three hours, with over 49,000 estimated downloads. Malware stole credentials and secrets; users were advised to remove the version and rotate credentials.
Key points
- Malicious LiteLLM 1.107.0 packages were available on PyPI and Docker for about three hours on October 21; downloads are estimated at over 49,000.
- LiteLLM says attackers likely obtained GitHub CLI OAuth tokens from logs of an internet-exposed internal deployment; how they accessed it or moved laterally remains unclear.
- The attackers used compromised credentials to disable branch protections, alter the release source, and run a workflow that published poisoned artifacts.
- The malware acted as an information stealer and RAT, collecting browser and developer credentials, cloud secrets, API keys, SSH keys, and other data.
- The stolen data was encrypted and sent to litellm[.]dev. Wiz observed use of stolen AWS credentials to query Amazon Bedrock, suggesting LLMjacking.
- LiteLLM said enterprise customers using its private repository were unaffected. Users of version 1.107.0 were advised to remove it, rotate credentials, and scan for malware; version 1.106.2 was identified as clean.
Article Details
- Victim Organization
- LiteLLM
- Incident Type
- Supply-chain compromise that distributed malicious LiteLLM packages containing an information stealer and RAT
- Data Types Exposed
- System information
- Browser credentials and cookies
- Developer credentials
- Environment variables
- Cloud secrets for AWS, GCP, and Azure
- AI tool API keys
- SSH private keys
- Shell history files
- GPG keys
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Malicious version 1.107.0 packages were available on PyPI and Docker for roughly three hours and were estimated to have been downloaded over 49,000 times. Users who installed them were infected. The packages were removed or replaced with clean artifacts; LiteLLM said enterprise customers using its private repository were not affected.
- Ransom Or Extortion
- Not disclosed
- Claim Status
- confirmed
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | litellm[.]dev | Malicious destination to which the malware sent encrypted stolen data. |
MITRE ATT&CK
T1005 · Data from Local SystemThe malware collected local data including shell history files and private keys.T1041 · Exfiltration Over C2 ChannelThe malware sent encrypted stolen data to a malicious destination.T1059.006 · PythonThe payload's files were executed when a Python interpreter ran, and the RAT ran Python supplied by the attacker.T1082 · System Information DiscoveryThe stealer harvested system information.T1195.002 · Compromise Software Supply ChainAttackers compromised the software release process and published poisoned LiteLLM packages.T1555.003 · Credentials from Web BrowsersThe stealer harvested browser credentials and cookies.
Vendors
DockerLiteLLM was compromised in a fresh supply chain attack, and malicious packages were served to its users on both PyPI and Docker.GitHubPer LiteLLM’s investigation, the attackers obtained the GitHub CLI OAuth tokens for “an unexpected, innocuously named user account in our internal LiteLLM deployment, which was exposed to the public internet”.
Products
Amazon BedrockWiz observed the attackers querying Amazon Bedrock models with stolen AWS credentials, suggesting LLMjacking.Claude CodeThe tokens were likely leaked by Claude Code, which, in specific circumstances, would embed them into a response body, which may be logged to LiteLLM logs. The attackers likely retrieved the tokens from the logs.GitHub CLIPer LiteLLM’s investigation, the attackers obtained the GitHub CLI OAuth tokens for “an unexpected, innocuously named user account in our internal LiteLLM deployment, which was exposed to the public internet”.LiteLLMLiteLLM was compromised in a fresh supply chain attack, and malicious packages were served to its users on both PyPI and Docker.