Skip to content
NewA calmer, faster ZeroHour
Malwarehigh

Malicious LiteLLM 1.107.0 steals credentials and installs a RAT

Original title: LiteLLM supply chain attack hoovers up passwords and secrets

The Register · Securityby Jessica Lyons ()3 min read
Read at theregister.com
Part of a story covered by 16 sourcesTrojanized LiteLLM 1.107.0 removed; users urged to rotate secretsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

PyPI and Docker removed the trojanized release within hours; the latest safe version named is v1.106.2.

Unknown attackers compromised LiteLLM's release process on Wednesday and published version 1.107.0 with an infostealer and a remote access trojan through PyPI and Docker. The package harvests browser, cloud, and LLM API credentials, encrypts them, and posts them to an attacker domain, while a startup daemon polls hourly for commands. PyPI quarantined the release and the Docker image was removed; BerriAI has not responded.

Unconfirmed: How many installations ran 1.107.0 is unknown, and BerriAI has not responded.

Key facts
  • Indicator files are /tmp/.pc_once_* and /tmp/remote_code_loader.lock.
  • Malicious commits came from github.com/Berri-AI/litellm, a hyphenated lookalike org.
  • Payload files named are cook.pth, cook.py, and sitecustomize.py.
  • The package was uploaded at 11:39 UTC and exfiltrates over HTTP POST.
  • LiteLLM is described as receiving about 23 million weekly downloads.
Security assessment · AI, from the article

Impact: Steals cloud, browser, and LLM credentials; runs code

ProductAffectedFixed in
BerriAI LiteLLM1.107.0, including Docker tags latest, main-latest, and main-stablev1.106.2
What to do
  1. 1.Stop deploying LiteLLM 1.107.0 and investigate hosts that ran it.
  2. 2.Check for /tmp/.pc_once_* and /tmp/remote_code_loader.lock.
  3. 3.Assume secrets on machines that ran the package were stolen.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1195.002 Compromise Software Supply ChainT1555.003 Credentials from Web BrowsersT1552.001 Credentials In FilesT1071.001 Web Protocols
Tags
litellmsupply-chaininfostealerpypidockercredential-theft
Vendors
BerriAI
Products
LiteLLM
Malware
cook.pysitecustomize.py
Organizations
Aikido SecurityWizSocket

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainwww.litellm.devdata via HTTP POST to an attacker-controlled domain: http://www[.]litellm[.]dev/healthcheck. BerriAI did not respond to The Register ’s

From the original article

3 min read at theregister.com

Unknown crims compromised LiteLLM's release process on Wednesday, distributing a malicious version (1. 107. 0) containing malware designed to steal cloud and AI credentials and a remote access trojan (RAT) capable of executing arbitrary code on infected machines through PyPI and Docker registries.

The Register · Security

By Jessica Lyons · theregister.com

Read the full article at The Register · Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.