In March, two compromised versions of LiteLLM were briefly available on the Python Package Index (PyPI), posing a significant security risk to organizations. These versions included malicious code designed to steal sensitive information such as cloud keys, SSH keys, and database passwords. The threat was identified and contained within 40 minutes, but not before potentially affecting over 2,500 organizations.
Extent of the Security Breach
CloudSEK, a threat intelligence firm, analyzed a dataset comprising approximately 434,000 files that were exfiltrated during this breach. Their report indicates that organizations across various sectors, including NVIDIA, Cisco, and Volkswagen, might have been exposed. However, it’s important to note that these figures represent potential exposure rather than confirmed cases of data theft.
The compromised versions of LiteLLM, specifically 1.82.7 and 1.82.8, were live on March 24, 2023, for a brief window before being quarantined. CloudSEK has made the dataset publicly accessible, allowing organizations to check their potential exposure based on their domain or name.
Technical Details and Impact
The LiteLLM packages were designed to execute as soon as any Python process started, collecting and encrypting sensitive data before sending it to an attacker-controlled domain. This breach is linked to a broader supply-chain attack associated with Aqua Security’s Trivy scanner, identified as CVE-2026-33634.
The FBI issued a warning in July 2023, advising organizations to rotate their credentials and avoid using long-lived tokens, which were vulnerable during the breach. Despite the closure of the initial breach window, credentials stolen during that period could still be exploited if not rotated or revoked.
Recommendations for Affected Organizations
Organizations potentially affected by the LiteLLM breach should immediately check for installations of the compromised versions during the specified window. It’s crucial to rotate any exposed credentials and review their GitHub repositories for specific indicators of compromise, as advised by the FBI.
Furthermore, companies are encouraged to adopt security best practices, such as using temporary tokens instead of long-lived ones, to mitigate future risks. The ongoing investigation by CloudSEK and other cybersecurity firms emphasizes the importance of vigilance and proactive security measures in safeguarding sensitive information.
The incident underscores the growing threat of supply-chain attacks in the open-source ecosystem, highlighting the need for robust security protocols and immediate incident response strategies.
