LiteLLM 1.107.0 Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

Overview

The popular LiteLLM Python package was compromised in a software supply chain attack, according to reports from SafeDep, Socket, StepSecurity, and Upwind. Version 1.107.0, distributed through PyPI wheels and Docker images, delivered a credential stealer and a persistent backdoor. PyPI has quarantined the package and the malicious Docker images have been removed.

Affected Artifacts

• LiteLLM 1.107.0 wheels for macOS (x86_64, arm64), manylinux (x86_64, aarch64), musllinux (x86_64, aarch64), and win_amd64
• Matching Docker images
• The source tarball litellm-1.107.0.tar.gz has no payload files but a tampered pyproject.toml

How the Malware Works

• Automatic execution: a cook.pth path file runs when the Python interpreter starts, so the malware executes even before LiteLLM is imported
• Credential theft (privcollect): harvests cloud tokens, developer account data, private keys, AI tool credential files, Chromium and Firefox browser data, environment variables, and saved LiteLLM proxy credentials and model configuration
• Exfiltration: data is packed into a GZIP-compressed TAR and POSTed to a LiteLLM-lookalike domain
• Backdoor: a background daemon checks a GitHub-hosted file hourly; if it contains a domain, the stealer re-runs and a Python payload is fetched and executed from that domain

Indicators of Compromise

Attribution and Root Cause

No threat actor has been named, though the behavior resembles the earlier TeamPCP attacks against LiteLLM. LiteLLM says three engineers' GitHub accounts were used, apparently via stolen GitHub CLI OAuth tokens: one account triggered the release workflow and another approved it. How the tokens were stolen is not yet known.

LiteLLM revoked the involved tokens, removed all but one unaffected user from its GitHub organization, and removed trusted publishing links to the organization from public registries.

Recommended Actions

1. Check every environment, CI runner, and container for LiteLLM 1.107.0
2. If found, treat the host as compromised and rotate all exposed credentials from a clean machine
3. Pin to 1.106.2 by digest
4. Search for cook.pth in site-packages and block the IOCs above
5. Restrict trusted publishing and require independent release approval

Sources

• The Hacker News: LiteLLM Compromised in Supply Chain Attack