LiteLLM, a well-known open-source proxy for managing requests across LLM providers, has been compromised in a recent supply chain attack. Discovered on October 21, this breach involved malicious packages being distributed on both PyPI and Docker platforms, impacting users who downloaded version 1.107.0.
Details of the Compromise
The malicious packages were accessible online for about three hours and were downloaded over 49,000 times before being removed. LiteLLM took swift action to remove these packages from PyPI, and Docker Hub tags and image variants were either deleted or redirected to clean versions.
According to LiteLLM’s investigation, the attackers exploited GitHub CLI OAuth tokens from an unsuspected user account within LiteLLM’s internal deployment, which was inadvertently exposed to the public. It is suspected that Claude Code leaked these tokens under specific circumstances, embedding them into response bodies logged by LiteLLM.
Attackers’ Strategy
The attackers utilized the compromised tokens to disable branch protections and merge a change redirecting the releaser to an alternate source repository. They executed a compromised GitHub workflow that linked to a lookalike repository, subsequently signing and distributing the malicious artifacts.
Users who downloaded the infected version 1.107.0 encountered malware designed as an information stealer and Remote Access Trojan (RAT). However, enterprise customers who accessed the private repository were reportedly unaffected.
Impact and Recommendations
The payload, possibly developed with AI assistance and distributed from a lookalike Berri-AI repository, deploys three files into the root of site-packages, executing when a Python interpreter runs. The malware collects a wide array of sensitive data, including system information, credentials, and API keys, which is then encrypted and sent to a suspicious domain.
Cybersecurity firm Wiz noted that the attackers began exploiting the stolen credentials approximately 4.5 hours post-exfiltration. Observations include querying Amazon Bedrock models using compromised AWS credentials, indicating a targeted LLMjacking effort.
The RAT component maintains regular communication with the attackers’ command-and-control server, checking a GitHub dead drop hourly to execute any Python code provided by the attackers. Affected users are advised to immediately uninstall the compromised version, rotate credentials, and perform a thorough malware scan. The most recent secure version, 1.106.2, is recommended for use.
For further reading, consider exploring related incidents such as the AOMEI Backupper and Rank Math PRO WordPress Plugin compromises, which highlight the growing threat of supply chain attacks in the software industry.
