LiteLLM was compromised in a fresh supply chain attack, and malicious packages were served to its users on both PyPI and Docker.
The incident occurred on October 21 and involved version 1.107.0 of the popular open source proxy for routing requests across LLM providers.
The malicious packages were online for roughly three hours and are estimated to have been downloaded over 49,000 times. The packages were removed from PyPI, and Docker Hub tags and image variants were either removed or repointed to clean artifacts.
[Read: Trivy, Not LiteLLM Behind the 2,500 Org Compromise ]
Per LiteLLM’s investigation, the attackers obtained the GitHub CLI OAuth tokens for “an unexpected, innocuously named user account in our internal LiteLLM deployment, which was exposed to the public internet”.
The tokens were likely leaked by Claude Code, which, in specific circumstances, would embed them into a response body, which may be logged to LiteLLM logs. The attackers likely retrieved the tokens from the logs.
However, it is still unclear how the attackers accessed the internal deployment or moved laterally, as they had access to three sets of developer GitHub CLI credentials, LiteLLM says.
The attackers used the compromised credentials to disable branch protections, merge a change that pointed the releaser to a different source repository, and run a compromised GitHub workflow that pointed to a lookalike repository, then signed and published the poisoned artifacts.
Users who downloaded the malicious LiteLLM version 1.107.0 packages during the compromise window were infected with malware that serves as an information stealer and a RAT. According to LiteLLM, its enterprise customers pulling from its private repository were not affected.
Likely built with the help of AI and served from Berri-AI/litellm, which poses as the legitimate BerriAI/litellm repository, the payload extracts three files into the site-packages root to be executed whenever a Python interpreter runs.
First, the interpreter loads the stealer, which harvests system information, browser credentials and cookies, developer credentials, environment variables, cloud secrets (AWS, GCP, and Azure), AI tool API keys (Anthropic, GitHub Copilot, OpenAI, and more), SSH private keys, shell history files, and GPG keys.
The stolen data is encrypted and sent to litellm[.]dev.
Cybersecurity outfit Wiz says the attackers started abusing the stolen credentials roughly 4.5 hours after they were exfiltrated.
Wiz observed the attackers querying Amazon Bedrock models with stolen AWS credentials, suggesting LLMjacking.
The RAT component of the malware was observed regularly checking with the attackers’ command-and-control (C&C) server. It also “checks a GitHub dead drop every hour and runs whatever Python the attacker serves,” StepSecurity notes.
Users who installed LiteLLM version 1.107.0 should immediately remove it, rotate their credentials, and sweep their systems for malware. The most recent clean LiteLLM version is 1.106.2.
Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Related: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Related: $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Related: Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
