On Wednesday, LiteLLM revealed a significant security breach where attackers bypassed several security measures to release a tampered version of their Python package. This compromised package included a credential-stealing component and a backdoor, posing serious risks to users.
Details of the Compromise
The breach occurred on October 21, 2026, when LiteLLM’s release pipeline was infiltrated. The malicious version, labeled 1.107.0, was distributed to the Docker Hub registry and the Python Package Index (PyPI) repository around 4:00 a.m. PST. The affected versions included several tagged releases for both Docker and GitHub Container Registry (GHCR).
Users who accessed the LiteLLM package or Docker image during specific time windows on October 21st may have been exposed. The malicious code was programmed to steal credentials and execute remote commands by connecting to a server every hour, effectively turning it into a remote access trojan (RAT).
Technical Analysis of the Malicious Code
The compromised package was designed to run a Python script named ‘cook.py,’ which obscured itself before executing a stealing routine. This script targeted various system secrets, transferring them via an HTTP POST request to a specified domain. Additionally, the malware attempted to execute a Linux and macOS-specific script, fetching further malicious content from a now-removed GitHub repository.
Researchers identified a unique dual-technique attack using both ‘.pth’ files and ‘sitecustomize.py,’ marking it as the first of its kind observed in the wild. This approach allowed the malware to persistently fetch updates and execute commands from an attacker-controlled domain.
Response and Preventative Measures
In response to the breach, LiteLLM has strengthened their release pipeline security. This includes moving releases to a private repository and making Docker tags immutable. The breach was facilitated by temporarily expanded release permissions, which attackers exploited using GitHub CLI credentials.
The company is investigating how a public exposure of an internal user account may have contributed to the breach, suspecting a recently patched vulnerability as the entry point. Developers are urged to remove the affected package, isolate compromised systems, and rotate credentials to mitigate potential damages.
While the investigation continues, security experts emphasize the importance of verifying package integrity and version control to avoid similar incidents. As the situation unfolds, organizations are advised to adopt stricter security practices to safeguard against such sophisticated cyber threats.
