Ethical Hacking News
LiteLLM, a popular AI package, has been compromised as part of a software supply chain attack, delivering a credential stealer and a backdoor. The attack affected LiteLLM 1.107.0, which was distributed through PyPI wheels and Docker images. Users are advised to revoke and replace exposed credentials from a clean environment and pin version 1.106.2 by digest.
LiteLLM Python package was compromised as part of a software supply chain attack. The malicious package was distributed through PyPI wheels and Docker images. The attack included a credential stealer and a backdoor, with the malicious package affecting LiteLLM 1.107.0. The compromise was part of a larger supply chain attack, with the threat actor using stolen GitHub CLI OAuth tokens. All tokens involved in the attack have been revoked, but the mechanism by which they were acquired has not been identified. LiteLLM has removed all but one user from its GitHub organization as a temporary mitigation measure. The malicious package collects cloud credentials, private keys, browser data, and authentication files for AI development tools. Users who have downloaded the malicious version are advised to revoke and replace exposed credentials from a clean environment and pin version 1.106.2 by digest.
The security landscape of the tech industry has recently been rocked by the compromise of the popular LiteLLM Python package as part of a software supply chain attack. This attack delivered a credential stealer and a backdoor, with the malicious package affecting LiteLLM 1.107.0, which was distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index (PyPI), and the malicious Docker images have been removed.
According to reports from SafeDep, Socket, StepSecurity, and Upwind, the compromise was part of a larger supply chain attack. The investigation into the incident is ongoing, with LiteLLM officials stating that they are still working to trace the original attack vector by which the threat actor published the malicious release. It appears that the malicious actions were taken through three engineers' GitHub accounts, which were compromised using stolen GitHub CLI OAuth tokens.
The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. All tokens which were involved in this attack have been revoked. However, the mechanism by which the threat actor acquired the relevant tokens has not yet been identified, and therefore, it cannot be confirmed that no further access to these GitHub accounts has been gained.
As a temporary mitigation measure, LiteLLM has removed all but one (unaffected) user from its GitHub organization. The organization has also updated the public registries to remove any trusted links to its GitHub organization, in order to prevent further publication of malicious packages.
Analysis of the malicious version of LiteLLM reveals that it is equipped with capabilities to collect cloud credentials, private keys, browser data, and authentication files for AI development tools. The affected wheels include litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl, litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl, litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl, and others.
The payload of the malicious package includes a credential stealer that calls itself privcollect, and a background daemon that checks a GitHub dead drop every hour and runs whatever Python the attacker serves. The malware is launched by Python even before LiteLLM is imported through a path file ("cook.pth"), which is designed to automatically execute code when the interpreter starts.
The "cook.pth" file contains a single line, "import cook," which, in turn, launches the credential collector payload. This payload includes harvesting cloud tokens, developer accounts and private keys, AI tooling credential JSON files, browser data associated with Chromium and Firefox, and environment variables. The malware is also capable of targeting LiteLLM deployments with an aim to extract the proxy's saved credentials and model configuration.
The collected data is packaged into a GZIP-compressed TAR archive and sent to "litellm[.]dev/healthcheck" by means of an HTTP POST request. Furthermore, the malware is designed to read the contents of a text file ("domain.txt") located within a GitHub repository ("github[.]com/letters9813"), check if it holds a domain and, if so, run the same stealer, and finally run an HTTP GET request against "/codepy" and execute the response.
Users who have downloaded the malicious version are advised to revoke and replace exposed credentials from a clean environment and pin version 1.106.2 by digest. This incident serves as a stark reminder of the importance of supply chain security and the need for robust vetting processes to prevent such attacks in the future.
Related Information:
https://www.ethicalhackingnews.com/articles/LiteLLM-A-High-Profile-AI-Package-Compromised-in-Software-Supply-Chain-Attack-ehn.shtml
https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
https://phoenix.security/teampcp-litellm-supply-chain-compromise-pypi-credential-stealer-kubernetes/
https://www.socinvestigation.com/comprehensive-list-of-apt-threat-groups-motives-and-attack-methods/
https://socradar.io/free-tools/threat-actor
Published: Wed Oct 21 18:46:25 2026 by llama3.2 3B Q4_K_M
