The LiteLLM Python package, a widely-used tool in the software development community, has recently fallen victim to a supply chain attack. This breach resulted in the distribution of a credential stealer and a backdoor, as reported by industry experts from SafeDep, Socket, StepSecurity, and Upwind.
Impact on LiteLLM and Response Measures
The compromised version, LiteLLM 1.107.0, was available through PyPI and Docker images before being quarantined. This incident prompted the removal of malicious Docker images and a thorough investigation by LiteLLM’s security team. Oliver Jensen, the security director at LiteLLM, stated that the attack involved stolen GitHub CLI OAuth tokens from three engineers. The investigation is ongoing to trace the attack’s origins and prevent future breaches.
As a precaution, all compromised tokens have been revoked, and the company has temporarily restricted access to its GitHub organization. Furthermore, LiteLLM has updated public registries to eliminate trusted links to its GitHub, aiming to halt further distribution of harmful packages.
Details of the Malicious Payload
Analysis of the tampered package revealed its capability to gather sensitive data, including cloud credentials, private keys, and browser information. The affected versions include several wheel files and a tampered tar.gz file. Known as ‘privcollect,’ the first payload steals credentials, while the second payload triggers a background process checking a GitHub dead drop for further commands.
This malware exploits a path file to execute code upon interpreter start, mirroring tactics seen in previous LiteLLM attacks linked to TeamPCP earlier this year. The ‘cook.pth’ file facilitates the launch of the credential collection process, targeting various sensitive data sources.
Recommendations for Affected Users
Users who have inadvertently downloaded the compromised version should immediately revoke and replace any exposed credentials. It’s crucial to operate from a secure environment and pin versions to 1.106.2 to prevent further vulnerabilities. Awareness and prompt action can significantly mitigate potential damage from this breach.
The malware also attempts to extract proxy credentials and model configurations from LiteLLM deployments, sending data to a specified domain. Additionally, it interacts with a GitHub repository to run further malicious actions, although the repository currently returns a 404 error.
Looking Ahead: Strengthening Security Measures
This incident underscores the importance of robust security protocols in software supply chains. As LiteLLM continues its investigation, the broader development community is reminded of the critical need for vigilance and comprehensive security strategies to safeguard against such attacks. Continuous monitoring and prompt response are essential in mitigating risks and preserving the integrity of software tools.
