Ethical Hacking News
LiteLLM has disclosed a recent incident where a malicious version of its Python package was released, exposing credentials and keys of users who downloaded the package between October 22nd and 23rd, 2026. The incident highlights the vulnerabilities that exist in open-source projects and the importance of secure coding practices.
The recent incident with LiteLLM highlights the vulnerabilities in open-source projects and the importance of secure coding practices. Threat actors compromised multiple security controls to push a malicious version of the Python package, containing a credential stealer and a backdoor. The attack was carried out by threat actors who had access to three sets of developer GitHub CLI credentials, including one that had the ability to run GitHub workflows. The use of a ".pth" file to launch the stealer program mirrors the modus operandi observed in a previous attack, but with different embedded RSA public keys and backdoor behavior. Developers are advised to remove the malicious package, isolate hosts, block access to the exfiltration domain, rotate credentials, and investigate the execution of "/codepy". The incident highlights the importance of incident response and the need for developers and security professionals to be proactive in identifying and mitigating vulnerabilities in open-source projects. The incident serves as a reminder that open-source projects are not immune to security vulnerabilities and that developers and security professionals must be vigilant in their approach to security.
A recent incident involving the open-source project LiteLLM has highlighted the vulnerabilities that exist in open-source projects and the importance of secure coding practices. According to a recent report, threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. This incident serves as a wake-up call for developers and security professionals to be more vigilant in their approach to open-source project security.
The incident began when LiteLLM's release pipeline was compromised on October 21, 2026, around 4:00 a.m. PST. The compromised versions were published on PyPI, Docker Hub registry, and GitHub Container Registry (GHCR). The malicious package was later discovered to contain a credential stealer and a backdoor, which were designed to harvest credentials and keys, and run arbitrary code from a remote server every hour, turning it into a remote access trojan (RAT).
The attack was carried out by threat actors who had access to three sets of developer GitHub CLI credentials, including one that had the ability to run GitHub workflows. The attackers used a token belonging to one of the GitHub organization owners to disable branch protections and force-push the malicious changes. They also ran a compromised workflow, pointing it to a lookalike repository "Berri-AI/litellm" instead of "BerriAI/litellm," causing the poisoned artifacts to be signed and published.
The use of a ".pth" file to launch the stealer program is notable as it mirrors the modus operandi observed in a March 2026 attack attributed to TeamPCP. However, Socket told The Hacker News that there is no evidence at this stage to link the two incidents. The embedded RSA public keys differ, as do the exfiltration implementation and backdoor behavior.
The incident highlights the importance of secure coding practices and the need for developers to be more vigilant in their approach to open-source project security. According to Wiz researchers Benjamin Read and Rami McCarthy, "The dual-technique approach, using both .pth files and sitecustomize.py simultaneously, appears to be the first documented case in the wild."
Developers are advised to remove LiteLLM 1.107.0 from their machines, isolate hosts on which the malicious version was installed, hunt for the malicious Python artifacts, block access to the exfiltration domain, rotate all credentials, and investigate the execution of "/codepy." JFrog security researcher Guy Korolevski said, "A single compromised install can hand an attacker the ability to push malicious code downstream. The lesson for security teams is that a clean source repository tells you little about the artifact you actually install, so verify the exact wheel and vet versions before they reach a build. If 1.107.0 ran anywhere in your environment, rotate every reachable credential and rebuild."
The incident also highlights the importance of incident response and the need for developers and security professionals to be proactive in identifying and mitigating vulnerabilities in open-source projects. According to LiteLLM, the company has hardened its release pipeline following a similar incident that took place earlier this March. This included moving releases to a private repository, making Docker release tags immutable, and signing Docker images.
In an advisory published Wednesday, LiteLLM said that the incident was a result of a combination of factors, including the use of GitHub CLI credentials and the lack of visibility into the release pipeline. The company has taken steps to address these issues, including expanding release permissions to allow two internal engineers to publish daily bugfix backports for customers.
The incident serves as a reminder that open-source projects are not immune to security vulnerabilities and that developers and security professionals must be vigilant in their approach to security. According to Aikido researcher Ilyas Makari, "It forks a background daemon that acquires a lock at '/tmp/remote_code_loader.lock' to prevent multiple instances, then enters an infinite loop. Every hour, the daemon fetches the attacker's current C2 domain from a GitHub repository (raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt), then fetches and executes a Python payload from http://{domain}/codepy."
The incident has also sparked concerns about the use of GitHub CLI credentials and the need for developers to be more mindful of their access controls. According to Wiz, the text file was only populated with initial test values prior to its takedown by GitHub around 1:30 p.m. UTC.
The use of a ".pth" file to launch the stealer program is notable as it mirrors the modus operandi observed in the March 2026 attack attributed to TeamPCP. However, Socket told The Hacker News that there is no evidence at this stage to link the two incidents. The embedded RSA public keys differ, as do the exfiltration implementation and backdoor behavior.
The incident highlights the importance of secure coding practices and the need for developers to be more vigilant in their approach to open-source project security. According to Wiz researchers Benjamin Read and Rami McCarthy, "The dual-technique approach, using both .pth files and sitecustomize.py simultaneously, appears to be the first documented case in the wild."
Related Information:
https://www.ethicalhackingnews.com/articles/LiteLLM-GitHub-Token-Leak-Exposes-Malicious-Package-Release-Highlights-Vulnerabilities-in-Open-Source-Projects-ehn.shtml
https://thehackernews.com/2026/10/litellm-suspects-github-token-leak-in.html
Published: Thu Oct 22 05:46:59 2026 by llama3.2 3B Q4_K_M
