Artificial Intelligence · Cybersecurity
LiteLLM release pipeline hacked to spread info-stealer malware
The LiteLLM project said its release pipeline was compromised on 21 October, letting attackers publish version 1.107.0 across package and container registries with malware that stole secrets and credentials.
- LiteLLM said an attacker compromised its release pipeline on 21 October and published version 1.107.0 to PyPI and container registries.
- The project said the affected release covered all seven PyPI wheels for 1.107.0 and tags on Docker Hub and GHCR.
- Socket and Endor Labs said the malicious package added cook.pth, cook.py and sitecustomize.py, which executed when Python started.
- The payload collected cloud, developer and browser data, encrypted it, and uploaded it to litellm[.]dev/healthcheck.
- The project said 1.106.2 was the latest clean release and noted a separate March breach involving TeamPCP and Aqua Security’s Trivy scanner.
The maintainers said the release system had been compromised on 21 October, and version 1.107.0 was then published to PyPI and container registries. They said the build contained malware that stole credentials and loaded remote-code execution tools, while users of the private enterprise offering were not affected.
The project said the incident covered the PyPI wheels for 1.107.0 and tags on Docker Hub and GHCR, some of which were available for hours before being removed or taken down. Security firms said they identified the malicious release within six minutes and found that the application code itself had not been changed.
According to the researchers, the installer package dropped three files into Python’s library area: cook.pth, cook.py and sitecustomize.py. Socket said Python processed the .pth file and then tried to import sitecustomize during normal start-up, so the payload ran before the application; Endor Labs said running Python or pip on an affected system could also trigger it.
The payload sought cloud and deployment credentials, AI tool authentication files, LiteLLM provider settings, developer secrets, browser data, and host information. The stolen data was encrypted with AES-256-CBC, wrapped with RSA-4096, and sent to litellm[.]dev/healthcheck.
One malicious file started a detached loader that checked a GitHub-hosted pointer each hour and fetched Python from an external server for execution. The project advised affected users to stop the deployment, inspect systems without starting Python, rebuild from clean backups, rotate exposed secrets, and use 1.106.2 as the latest clean release; it also said it had suffered a separate March breach tied to TeamPCP and Aqua Security’s Trivy scanner.
Named in this story
Companies
- Socket
- one of the security firms that analysed the malicious package
- Endor Labs
- one of the security firms that examined how the payload ran
- Aqua Security
- the company whose Trivy scanner was said to have been breached in March
Organisations
- TeamPCP
- the hacking group named in the earlier March breach
Products and systems
- LiteLLM
- the open-source Python SDK and AI gateway whose release pipeline was compromised
- PyPI
- the package registry where the malicious release was published
- Docker Hub
- the container registry where compromised images were pointed to
- GHCR
- the container registry where compromised image tags were hosted
- Trivy vulnerability scanner
- the scanner whose compromise enabled the earlier March incident
How the source tells it
The piece was mostly a straightforward incident report, with a promotional aside about LiteLLM’s scale and a brief urgent remediation note.
- hype uses download and star counts plus a list of big-name adopters to amplify the project’s scale
- urgency pairs the report with immediate isolation, rebuild and secret-rotation instructions