The LiteLLM Python package was compromised in a software supply chain attack that planted a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity and Upwind.

The affected release, LiteLLM 1.107.0, was distributed through PyPI wheels and Docker images. PyPI has since quarantined the package, and the malicious Docker images have been pulled.

Oliver Jensen, director of security at LiteLLM, said the investigation is ongoing and the company is still tracing how the attacker published the malicious release. He said the actions were taken through three engineers' GitHub accounts, apparently via stolen GitHub CLI OAuth tokens. One account triggered the project-releaser run and another approved it, Jensen said, adding that all tokens involved have been revoked.

He said the mechanism by which the tokens were obtained has not been identified, so the company cannot yet rule out further access to those accounts. As a temporary mitigation, all but one unaffected user have been removed from the GitHub organization. LiteLLM also said it updated public registries to remove trusted links to its GitHub organization, preventing further publication of malicious packages.

Analysis shows the malicious version collects cloud credentials, private keys, browser data and authentication files for AI development tools, including saved proxy credentials and model configuration from LiteLLM deployments. The data is packed into a GZIP-compressed TAR archive and sent via HTTP POST to litellm[.]dev/healthcheck.

StepSecurity said the first payload is a credential stealer calling itself privcollect, while the second forks a background daemon that checks a GitHub dead drop every hour and runs whatever Python the attacker serves. The malware runs before LiteLLM is even imported, through a path file named cook.pth that executes on interpreter startup - behavior also seen in the earlier TeamPCP supply chain attacks this March.

Users who downloaded the malicious version are advised to revoke and replace exposed credentials from a clean environment and pin version 1.106.2 by digest.

Source: The Hackers News