Exposed LiteLLM Key Enabled Malicious PyPI Release and Credential Theft
Summary
LiteLLM said an unrevoked master key exposed in May was used to obtain GitHub and maintainer tokens, enabling a malicious PyPI 1.107.0 release that ran credential-stealing code. The package was available for about two hours.
Key points
- LiteLLM said an attacker used a previously exposed, unrevoked master key to access its Agent Platform on Oct. 10 and extract a GitHub CLI OAuth token.
- The attacker reportedly obtained two maintainers’ tokens and rerouted the release workflow to a malicious repository.
- Malicious package version 1.107.0 and a container image were published on Oct. 21 and remained available for about two hours; ClickPy data showed about 50,000 downloads during that period.
- The package used Python startup mechanisms to run credential-harvesting code on affected systems, including developer workstations and CI/CD agents.
- The payload, named “privcollect” by the attacker, targeted browser secrets, cloud credentials, LLM-provider API keys, SSH and GPG keys, and shell history.
- Wiz researchers said exploitation of stolen credentials began about four and a half hours after exfiltration; Microsoft reported that additional Python code execution was possible on Unix-based systems, but none was detected.
Article Details
- Victim Organization
- LiteLLM
- Incident Type
- Software supply-chain attack involving an exposed master key, theft of GitHub authentication tokens, and a malware-laden PyPI release and container image.
- Data Types Exposed
- Credentials and authentication tokens, including a GitHub CLI OAuth token and code-maintainer tokens.
- The malware targeted browser secrets and cookies, cloud credentials, LLM-provider API keys, SSH private keys, GPG keys, and shell history; the article does not confirm that every targeted data type was exfiltrated.
- Operational Impact
- Malicious package version 1.107.0 and a malicious container image were available for about two hours. ClickPy data reportedly showed about 50,000 downloads during that period. Systems that started Python with the affected package installed could execute the credential-harvesting payload. The attacker also used stolen credentials to validate AWS instance-role credentials across multiple environments.
- Claim Status
- confirmed
MITRE ATT&CK
T1195.001 · Compromise Software Dependencies and Development ToolsThe attacker rerouted the release workflow and published a malware-laden package through the PyPI software supply chain.T1528 · Steal Application Access TokenThe attacker extracted LiteLLM's GitHub CLI OAuth token and acquired code-maintainer tokens.