Alert! Malicious LiteLLM package is stealing credentials and enabling RCE

The malware collects cloud, SSH, CI/CD, and browser credentials, along with tokens for AI coding tools, and establishes an hourly channel for remote code execution, according to researchers at software supply chain firm JFrog.

Any host that installed the package may be affected, including developer workstations, build systems, cloud workloads, containers, and LiteLLM proxy deployments. Stolen credentials could allow attackers to push malicious code or compromise software packages further.

This incident marks the second LiteLLM hijack this year. The library is downloaded hundreds of millions of times a month from PyPI, the Python Package Index.

“A single compromised install can hand an attacker the ability to push malicious code downstream,” said Guy Korolevski, JFrog security researcher.

“The lesson for security teams is that a clean source repository tells you little about the artifact you actually install, so verify the exact wheel and vet versions before they reach a build.”

Korolevski said organisations that had run version 1.107.0 should rotate every reachable credential and rebuild affected environments.

VIEW ALL

For its part, the maintainers of LiteLLM have since marked the incident as contained, as well as explaining how the attack occurred.

“We believe we have identified the attack chain which facilitated this attack,” LiteLLM said in an October 21 blog post.

“The attacker had to compromise multiple independent security controls to be successful.

“We identified an unexpected, innocuously named user account in our internal LiteLLM deployment, which was exposed to the public internet. We believe the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise our release workflow.”