LiteLLM supply chain attack planted stealer and backdoor
The LiteLLM supply chain attack compromised version 1.107.0 of the Python package, meaning malicious code was inserted into software distributed through an established development channel. Reports from SafeDep, Socket, StepSecurity and Upwind found a credential stealer, which searches for authentication data, together with a backdoor that could execute Python code supplied by the attacker. The affected release was distributed as Python Package Index (PyPI) wheels and Docker images. A wheel is an installable Python package file, while a Docker image is a packaged environment used to run an application in a container.
PyPI has quarantined the compromised package, and the malicious Docker images have been removed. LiteLLM said its investigation remains in progress and that it has not established how the attacker initially gained the ability to publish the release. The organisation also removed trusted links between its GitHub organisation and public registries to prevent those connections from being used to publish additional packages.
According to LiteLLM, the malicious actions involved three engineers' GitHub accounts and appeared to rely on stolen GitHub command-line interface OAuth tokens. An OAuth token is a digital credential that allows an application or tool to act through an account without repeatedly requesting its password. The attacker used one account to start the project's release workflow, called project-releaser, and another account to approve it. LiteLLM revoked every token known to have been involved. However, it has not determined how the tokens were obtained and said it could not yet rule out additional access to the affected accounts. As a temporary measure, it removed every user except one unaffected account from its GitHub organisation.
The affected files are litellm-1.107.0-cp310-abi3-macosx_10_12_x86_64.whl, litellm-1.107.0-cp310-abi3-macosx_11_0_arm64.whl, litellm-1.107.0-cp310-abi3-manylinux_2_28_aarch64.whl, litellm-1.107.0-cp310-abi3-manylinux_2_28_x86_64.whl, litellm-1.107.0-cp310-abi3-musllinux_1_2_aarch64.whl, litellm-1.107.0-cp310-abi3-musllinux_1_2_x86_64.whl and litellm-1.107.0-cp310-abi3-win_amd64.whl. The litellm-1.107.0.tar.gz archive did not contain the payload files, but its pyproject.toml configuration file had been altered.
StepSecurity identified two malicious components. The first, which calls itself privcollect, gathers credentials and other sensitive information. The second creates a background daemon, a program that continues running without an open window, and checks a location on GitHub every hour. If attacker-controlled Python code is available there, the daemon runs it. This gives the compromise capabilities beyond one-time data theft because an infected system could later receive and execute additional instructions.
The malware starts before a user imports LiteLLM into a program. It achieves this through cook.pth, a Python path file that the interpreter processes automatically during startup. That file contains an instruction to import a module named cook, which launches the credential collector. Similar startup behaviour was observed during the earlier LiteLLM compromise associated with the TeamPCP supply chain attacks in March.
The collector searches for cloud access details, developer account credentials, private keys, authentication files used by artificial intelligence development tools, Chromium and Firefox browser data, and environment variables, which are system settings that applications often use to store configuration or secrets. It can also inspect LiteLLM deployments for credentials saved by the proxy and for model configuration. The stolen material is placed in a GZIP-compressed TAR archive and sent through an HTTP POST web request to litellm[.]dev/healthcheck.
The backdoor also reads domain.txt from the GitHub repository github[.]com/letters9813. If the file contains a domain, the malware runs the stealer again, requests content from the domain's /codepy path and executes the response. The repository currently returns a 404 error, indicating that the requested location is unavailable, but systems that already ran the compromised package still require remediation.
Users who downloaded LiteLLM 1.107.0 are advised to revoke and replace potentially exposed credentials from a clean environment, meaning a separate system that did not run the malicious release. The recommendation is to use version 1.106.2 and pin it by digest, a fixed fingerprint that ensures the expected package or image is installed. Because the stealer targeted cloud accounts, browsers, private keys, development tools and LiteLLM proxy data, remediation should cover all credentials present on the affected machine rather than only a LiteLLM account.
For businesses addressing this kind of development and hosting risk, AEU-I provides security-first IT, infrastructure and consulting. The removal of the package and Docker images limits new downloads, but it does not remove malware from systems where version 1.107.0 was already installed or replace information that may have been collected.