LiteLLM release pipeline hacked to distribute info-stealer malware
Malicious LiteLLM 1.107.0 wheels and images were live for hours on October 21; roll back to 1.106.2 and rotate secrets.
The LiteLLM maintainer says the release pipeline was compromised on October 21 and a threat actor published version 1.107.0 to PyPI and container registries. All seven PyPI wheels and several Docker Hub and GHCR tags pointed to packages that steal credentials and can load remote-code execution tools. Private enterprise customers were not impacted, researchers detected the publication within six minutes, and the malicious artifacts were later removed.
Unconfirmed: The maintainer does not identify who compromised the pipeline.
- PyPI wheels were live from 11:39:51 to 13:23 UTC.
- Docker Hub tags remained compromised until 14:20 UTC; GHCR tags until 13:51 UTC.
- Payload files were cook.pth, cook.py and sitecustomize.py, not application code changes.
- Stolen data was encrypted and uploaded to litellm[.]dev/healthcheck.
- A detached loader checks a GitHub pointer hourly and downloads Python for execution.
Impact: Steals credentials, secrets and can load remote code
| Product | Affected | Fixed in |
|---|---|---|
| BerriAI LiteLLM | 1.107.0 | 1.106.2 |
- 1.Stop affected deployments and inspect them without launching Python.
- 2.Isolate infected systems, rebuild from clean backups, and rotate exposed secrets.
- 3.Use LiteLLM 1.106.2, the latest clean release before the attack.
- ATT&CK
- T1195.002 Compromise Software Supply ChainT1552 Unsecured CredentialsT1059.006 PythonT1105 Ingress Tool Transfer
- Vendors
- BerriAI
- Products
- LiteLLM
- Organizations
- SocketEndor Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | hat is encrypted with an RSA-4096 key and then uploaded to ‘litellm[.]dev/healthcheck’ One of the malicious files, sitecustomize.py |
| sha256 | 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e | and main-stable: pointed to compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTC GHCR: v1.107.0, latest, main-lat |
From the original article
3 min read at bleepingcomputer.com
Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.