Artificial Intelligence
LiteLLM compromise delivered stealer and backdoor
Reports said LiteLLM 1.107.0 was tampered with in a supply chain attack that pushed a credential stealer and backdoor through PyPI wheels and Docker images before quarantine and removal.
- SafeDep, Socket, StepSecurity and Upwind said LiteLLM 1.107.0 had been compromised in a supply chain attack.
- LiteLLM said the incident was still under investigation and that the release appeared to have been published through three engineers’ GitHub accounts.
- The company said the access tokens involved had been revoked, while PyPI quarantined the package and the malicious Docker images were removed.
- StepSecurity said the first payload was a credential stealer called privcollect, and that a second payload checked a GitHub dead drop each hour.
- The analysis said the malware could collect cloud credentials, private keys, browser data, AI tool authentication files and environment variables.
SafeDep, Socket, StepSecurity and Upwind said LiteLLM 1.107.0 had been compromised in a supply chain attack. The package was distributed as PyPI wheels and Docker images, and PyPI quarantined it while the malicious images were taken down.
Oliver Jensen, LiteLLM’s security director, said the company was still investigating the incident. He said the release appeared to have been published through three engineers’ GitHub accounts, with stolen GitHub CLI OAuth tokens as the suspected route, and that the tokens had been revoked.
Jensen said the company had not yet established how those tokens were obtained. He said LiteLLM had removed all but one unaffected user from its GitHub organisation and had removed trusted links from public registries to reduce the chance of further malicious uploads.
StepSecurity said the first payload was a credential stealer named privcollect, and that a second component checked a GitHub dead drop every hour before running attacker-supplied Python. The analysis said the code could gather cloud tokens, private keys, browser data, AI development tool credentials and environment variables, then send the archive to litellm[.]dev/healthcheck.
The article said users who had downloaded the package should replace exposed credentials from a clean system and pin version 1.106.2 by digest. It also said the malicious tarball contained no payload files, but did include a modified pyproject.toml.
Named in this story
People
- Oliver Jensen
- LiteLLM’s security director who described the investigation
Companies
- SafeDep
- One of the groups that reported on the compromise
- Socket
- One of the groups that reported on the compromise
- StepSecurity
- Analysed the payloads and described the malware
- Upwind
- One of the groups that reported on the compromise
- GitHub
- The account platform used in the reported attack
Organisations
- Python Package Index (PyPI)
- Quarantined the package
Products and systems
- LiteLLM
- The package whose 1.107.0 release was tampered with
- privcollect
- The credential-stealing payload identified in the malicious release
How the source tells it
The piece is a straight incident report, with urgency supplied by the remediation advice and the repeated description of the package as malicious.
- alarm Repeated use of charged labels for the package and payloads frames the incident as threatening
- urgency The closing advice tells users to revoke exposed credentials and pin a safe version