The popular **LiteLLM** Python package, version 1.107.0, has been compromised in a software supply chain attack. Reports from security firms like **SafeDep**, **Socket**, **StepSecurity**, and **Upwind** confirm the malicious inclusion of a credential stealer and a backdoor. ### Incident Details and Remediation The affected version was distributed through **PyPI** wheels and Docker images. **PyPI** has since quarantined the package, and the malicious Docker images have been removed. **Oliver Jensen**, Director of Security at **LiteLLM**, stated that an investigation is ongoing to trace the original attack vector. "We have identified that the malicious actions were taken through three engineers' GitHub accounts, appearing to be by way of stolen GitHub CLI OAuth tokens," Jensen confirmed. "The threat actor used one user's account to trigger the project-releaser run, and another user's account to approve it. All tokens which were involved in this attack have been revoked." **LiteLLM** has also updated public registries to remove trusted links to its GitHub organization, aiming to prevent further malicious package publications. The mechanism for token acquisition remains under investigation. ### The Malicious Payload Analysis reveals that the compromised version is designed to collect sensitive data, including cloud credentials, private keys, browser data, and authentication files for AI development tools. The following **PyPI** wheels are known to be affected: * `litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl` * `litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl` * `litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl` * `litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl` * `litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl` * `litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl` * `litellm-1.107.0-cp310-abi3-win_amd64.whl` * `litellm-1.107.0.tar.gz` (No payload files, but contains a tampered `pyproject.toml`) **StepSecurity** detailed the two main payloads: a credential stealer dubbed "privcollect" and a background daemon that periodically checks a GitHub dead drop for additional Python code to execute. ### Execution and Data Exfiltration The malware leverages a path file, `cook.pth`, to automatically execute code when the Python interpreter starts, even before **LiteLLM** is imported. This technique was also observed in previous **LiteLLM** compromises linked to the **TeamPCP** supply chain attacks earlier this year. The `cook.pth` file contains a single line, `import cook`, which triggers the credential collector. This payload targets cloud tokens, developer accounts, private keys, AI tooling credential JSON files, Chromium and Firefox browser data, and environment variables. It also aims to extract saved credentials and model configurations from **LiteLLM** deployments. Collected data is compressed into a GZIP-TAR archive and exfiltrated to `litellm[.]dev/healthcheck` via an HTTP POST request. Furthermore, the malware attempts to fetch and execute additional Python code from a text file (`domain.txt`) hosted on a GitHub repository (`github[.]com/letters9813`), though this repository currently returns a 404 error. ### Recommendations for Users Users who have downloaded the malicious version 1.107.0 of **LiteLLM** are strongly advised to: 1. **Revoke and replace all exposed credentials** immediately from a clean, uncompromised environment. 2. **Pin their **LiteLLM** version to 1.106.2 by digest** to ensure they are using a known safe version and prevent automatic updates to potentially compromised releases. This incident underscores the critical importance of robust software supply chain security practices and continuous vigilance against evolving threats.