LiteLLM Supply Chain Attack Compromises PyPI and Docker
Merely launching Python after installing LiteLLM triggered immediate credential theft. On October 21, threat actors injected a malicious data stealer into version 1.107.0. The compromise affected all seven PyPI wheel releases and official Docker container images. Developers confirmed the breach in an urgent LiteLLM supply chain incident report.
Silent Execution via Path Configuration Traps
The intrusion relied on an insidious installation mechanism. Specifically, the attacker placed a rogue file named cook.pth inside the site-packages directory. Whenever Python initializes, the runtime automatically executes all discovered path configuration files. Consequently, the environment executed cook.py without any direct import calls from user applications.
Furthermore, cybersecurity analysts at Upwind discovered a companion sitecustomize.py script. This script launched a covert background process to receive arbitrary commands.
Widespread Credential Harvesting and Exfiltration
Once active, the spyware combed system disks for sensitive credentials. The payload extracted stored browser passwords, cookies, and SSH cryptographic keys. Additionally, the malware scavenged cloud API tokens for GitHub, AWS, Azure, and Google Cloud.
Targeting Enterprise Artificial Intelligence Keys
Within active AI environments, the script exfiltrated connected model provider keys directly from resident databases. The malware encrypted harvested credentials before transmitting them to litellm.dev, an unauthorized external domain.
Moreover, the stealer contacted a remote repository hourly to establish secondary persistence. Although this secondary stage remained inactive during initial discovery, Windows systems remained vulnerable to primary credential theft.
Deceptive Repository Cloning and Token Compromise
Surprisingly, the rogue code never appeared in the official project repository. Instead, the attackers deployed a typo-squatted clone named Berri-AI/litellm, inserting a misleading hyphen. The intruders compromised GitHub CLI tokens belonging to three project maintainers. Consequently, the attackers bypassed branch protection rules, approved unauthorized builds, and deleted administrative audit logs.
Project engineers suspect that internal gateway logs inadvertently leaked these credentials. Specifically, Claude Code reportedly embedded CLI authorization tokens in raw responses stored in accessible logs.
Emergency Remediation and Quarantine Measures
The infected distribution remained live on PyPI for nearly two hours. Meanwhile, malicious Docker containers lingered for almost three hours before maintainers revoked them. Fortunately, private enterprise registries remained uncompromised throughout the ordeal.
Critical Decontamination Procedures
Security experts advise removing malicious files manually before invoking any Python commands. Remarkably, executing pip commands can inadvertently trigger dormant path scripts. Finally, administrators must rebuild virtual environments, revert to clean release 1.106.2, and rotate all system secrets.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
