HOC Shorts |
The Incident: The widely used AI developer tool LiteLLM compromised in a software supply chain attack.
- The Malicious Release: Threat actors published malicious package version `1.107.0` across PyPI wheels, source tarballs, and official Docker registries.
- Payload Functionality: The package deploys a credential harvester (`privcollect`) targeting cloud tokens, private keys, browser data, and AI tooling files, alongside a persistent backdoor using a GitHub dead-drop resolver.
- Vector: LiteLLM security leads confirmed attackers utilized stolen GitHub CLI OAuth tokens across multiple developer accounts to trigger and approve the malicious release pipeline.
- Immediate Action: PyPI quarantined the package, and users must immediately downgrade/pin version `1.106.2` while revoking all exposed cloud credentials and API keys.
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The widely used LiteLLM Python package, which helps engineering teams integrate with multiple Large Language Models through a unified API, has experienced a serious security incident. Security researchers reported that unauthorized code was published through official distribution channels, potentially exposing sensitive credentials at risk and allowing unauthorized access to affected systems.
PyPI has quarantined the affected package version, and maintainers have pulled compromised Docker images while investigating how attackers infiltrated their release infrastructure.
1. Pre-Import Execution (`cook.pth`): The malicious package leverages a Python `.pth` path configuration file named `cook.pth` containing the single line `import cook`. This forces the Python interpreter to execute malicious code automatically even before the application explicitly imports LiteLLM.
2. Credential Harvester (`privcollect`): The first payload scans the compromised host to collect sensitive data, including cloud provider tokens, developer accounts, private keys, Chromium/Firefox browser data, environment variables, and saved LiteLLM proxy configurations. Collected data is compressed into a GZIP archive and exfiltrated via an HTTP POST request.
3. GitHub Dead-Drop Backdoor: The second payload establishes a background daemon thread that queries a designated GitHub repository every hour (`[github.com/letters9813/domain.txt], checks for a command domain, downloads remote instructions via HTTP GET (`/codepy`), and executes arbitrary Python code on the victim system.
In August we have reported LiteLLM breached exposed 2500+ companies.
weRoot Cause: Stolen GitHub CLI OAuth Tokens
LiteLLM security confirmed that the attackers bypassed standard controls by hijacking internal developer credentials:
- Compromised Accounts: Threat actors leveraged stolen GitHub CLI OAuth tokens belonging to three separate engineers.
- Pipeline Abuse: One compromised account triggered the automated project-releaser build pipeline, while a second hijacked account approved the malicious release.
- Remediation Steps: LiteLLM has revoked all tokens involved in the attack, purged all external collaborators from their GitHub organization except for one unaffected administrator, and severed public repository links to prevent further automated distribution.
Action Plan for Developers
Organizations running LiteLLM deployments must execute the following remediation workflow immediately:
1. Pin Safe Version: Downgrade and pin your environment to `1.106.2` by digest or version constraint. Avoid any builds tied to version `1.107.0`.
2. Credential Rotation: Assume all API keys, cloud provider tokens, database connection strings, and LLM provider credentials stored on servers running the compromised package have been exfiltrated. Revoke and reissue all keys from a completely clean machine.
3. Inspect Infrastructure: Audit worker nodes for unexpected `.pth` files in Python site-packages and review outbound network traffic for anomalous HTTP POST requests or dead-drop polling activity.
