On Wednesday, a harmful version of LiteLLM was uploaded to PyPI and Docker platforms, containing malware designed to steal cloud access details, sensitive developer information, and API keys for AI services from users who installed it.
Kevin Beaumont, a cybersecurity expert, posted on Mastodon, “LiteLLM got compromised… again.”
In August, Hudson Rock examined a 153GB file stolen during a previous LiteLLM supply chain breach in March, linking it to 2,488 corporate networks, including AWS, Samsung, Cisco, and Salesforce. CloudSEK estimated nearly 2,500 organizations were exposed.
Malicious Package Details
LiteLLM’s blog states, “At 4:00 AM PST October 21, LiteLLM’s release pipeline was compromised and pushed v1.107.0 to the docker registry and PyPi. This version contained compiled malware which steals credentials and loads remote-code execution tools.”
The harmful package remained on PyPI from 11:39 to 13:23 UTC, while Docker images labeled v1.107.0, latest, main-latest, and main-stable distributed the corrupted version from 11:46 to 14:20 UTC.
Impact and Response
Researchers Benjamin Read and Rami McCarthy from Wiz confirmed v1.106.2 as the latest safe version. They warned that updating alone is insufficient. Aikido researcher Ilyas Makari advised those who installed 1.107.0 before its removal to assume their credentials are compromised and reset them.
LiteLLM discovered an unexpected, innocuously named account in its internal system, accessible via the public internet. The company suspects the attacker used this access to extract GitHub CLI OAuth tokens from logs, compromising the release process.
LiteLLM noted instances where Claude Code includes a user’s GitHub CLI OAuth token in responses. When these responses are logged, the tokens may appear in LiteLLM logs.
Attack Details
The malicious LiteLLM code activates whenever Python starts in an affected system, even if the application does not use LiteLLM. It was inserted into Python startup files, allowing it to run alongside API keys, cloud credentials, and database connections.
The malware targets Git credentials, SSH and GPG keys, saved browser data, browsing history, and shell records. It also seeks authentication files for Codex, Claude, Gemini, and Cursor.
Wiz researchers observed the stolen credentials in use. Approximately four and a half hours after extraction, the attacker tested AWS credentials from compromised CI runners and Kubernetes nodes, attempting to access AI models on Amazon Bedrock.
Aikido, Wiz, and Socket have released detailed reports with indicators of compromise and cleanup instructions for LiteLLM users and security teams.
Leave a Reply