A LiteLLM supply-chain attack compromised the project’s release pipeline and distributed credential-stealing malware through PyPI and container registries. The malicious release, version 1.107.0, targeted Windows, Linux and macOS environments.
Maintainers said attackers breached the pipeline on October 21 and published packages containing compiled malware and tools for remote code execution. However, the incident did not affect customers running the private enterprise offering.
LiteLLM provides an open-source Python SDK and AI gateway that connects applications to multiple model providers through a common API.
Malicious Release Reached Multiple Distribution Channels
The compromise affected all seven PyPI wheels for LiteLLM 1.107.0. Those installation packages remained available on October 21 between 11:39:51 and 13:23 UTC.
Meanwhile, attackers also distributed compromised container images through Docker Hub and GitHub Container Registry.
On Docker Hub, the affected tags were:
- v1.107.0
- latest
- main-latest
- main-stable
Those tags pointed to a malicious image between 11:46:56 and 14:20 UTC.
The same tags also affected the LiteLLM, LiteLLM Database and LiteLLM Non-Root images on GitHub Container Registry. Exposure began at 11:46:56 UTC, and the compromised images were unavailable by 13:51 UTC.
Security companies detected the malicious release within six minutes of publication. Nevertheless, the distribution window created opportunities for automated installations and deployments to pull the compromised artifacts.
Malware Ran During Python Startup
Researchers found that the attackers modified the installation package rather than LiteLLM’s application code.
Specifically, they placed three malicious files in the environment’s Python library directory: cook.pth, cook.py and sitecustomize.py.
Python processes executable instructions in certain .pth files during normal startup. It also attempts to import sitecustomize, giving the attackers another way to launch their payload.
Consequently, the malware could execute before the application whenever Python started in the affected environment.
Even launching Python or pip to investigate the installation could trigger the malicious code. This behaviour makes ordinary troubleshooting potentially dangerous on compromised systems.
Stolen Data Extended Beyond AI API Keys
The LiteLLM supply-chain attack targeted credentials and sensitive information across development environments, cloud services and browsers.
Researchers identified five main categories:
- Cloud credentials: AWS, Azure, Google Cloud, Kubernetes, Docker and infrastructure-management secrets.
- AI configuration: Authentication files for AI development tools, stored provider credentials and LiteLLM model settings.
- Developer secrets: Git, GitHub, npm, PyPI and CI/CD credentials, alongside .env files and private keys.
- Browser databases: Saved logins, cookies, autofill information, payment data and browsing history.
- System information: Environment variables, command histories, application histories and network details.
The malware encrypted collected data using AES-256-CBC, then protected the encryption key with RSA-4096. It subsequently uploaded the material to an attacker-controlled endpoint impersonating a LiteLLM health-check service.
Background Loader Could Retrieve Additional Code
Beyond stealing information, sitecustomize.py launched a detached loader that could continue operating separately from the application.
The loader checked a GitHub-hosted pointer every hour. It then retrieved additional Python code from an external server for execution on the host.
As a result, deleting the LiteLLM package directory alone might not remove the entire infection. Malicious startup files or an active loader could remain elsewhere in the environment.
Recovery Requires More Than Replacing the Package
Maintainers removed the malicious packages and identified LiteLLM 1.106.2 as the clean recovery release in their incident guidance.
Potentially affected users should stop compromised deployments and inspect their environments without launching Python. Additionally, they should isolate infected systems and rebuild them from clean backups.
All exposed secrets should undergo immediate rotation. This includes credentials that the malware could access beyond the affected application’s own configuration.
Simply installing a clean LiteLLM version does not address stolen credentials or malicious files left behind.
Earlier Breach Also Targeted the Release Process
The October incident follows a separate LiteLLM compromise in March.
In that attack, the TeamPCP group published malicious PyPI releases after compromising Aqua Security’s Trivy vulnerability scanner, which LiteLLM used in its CI/CD pipeline.
Both incidents show how a compromised release process can deliver malicious software through otherwise trusted distribution channels.
0 responses to “LiteLLM Supply-Chain Attack Spreads Malware Through Python Packages and Docker Images”