Malicious LiteLLM 1.107.0 ships stealer and backdoor
Original title: LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
PyPI quarantined the release and Docker images were removed; users should pin 1.106.2 and rotate exposed credentials.
SafeDep, Socket, StepSecurity, and Upwind report that LiteLLM 1.107.0 on PyPI and in Docker images carried a credential stealer and a backdoor. LiteLLM’s Oliver Jensen said stolen GitHub CLI OAuth tokens on three engineers’ accounts were used to trigger and approve the release, and those tokens were revoked. The package is quarantined, malicious images were removed, and how the tokens were obtained is still unknown.
Unconfirmed: LiteLLM has not identified how the GitHub CLI OAuth tokens were acquired.
- A cook.pth file imports code before LiteLLM itself is imported.
- The stealer, called privcollect, packs data and POSTs it to litellm.dev.
- A second payload checks a GitHub dead drop hourly and runs fetched Python.
- Seven platform wheels plus the 1.107.0 source tarball are listed as affected.
- LiteLLM removed all but one unaffected user from its GitHub organization.
Impact: Steals cloud credentials, keys, browser data, and AI tool secrets
| Product | Affected | Fixed in |
|---|---|---|
| LiteLLM | 1.107.0 | 1.106.2 |
- 1.Pin LiteLLM 1.106.2 by digest and do not use the listed 1.107.0 wheels.
- 2.Revoke and replace exposed credentials from a clean environment.
- 3.Treat GitHub tokens used in the release as compromised; LiteLLM says they were revoked.
- ATT&CK
- T1195.001 Compromise Software Dependencies and Development ToolsT1552.001 Credentials In FilesT1555.003 Credentials from Web Browsers
- Products
- LiteLLM
- Malware
- privcollect
- Organizations
- SafeDepSocketStepSecurityUpwind
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | litellm.dev | is packaged into a GZIP-compressed TAR archive and sent to "litellm[.]dev/healthcheck" by means of an HTTP POST request. In additio |
From the original article
2 min read at thehackernews.com
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind. The compromise affects LiteLLM 1. 107.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.