LiteLLM Supply Chain Attack: Info-Stealer Malware Compromises Developer Secrets

How the Breach Occurred

Cybercriminals successfully compromised the release pipeline of the popular open-source project LiteLLM. This breach allowed them to inject malicious code into legitimate LiteLLM packages, specifically version 1.107.0, which was then distributed via PyPI (Python Package Index) and Docker Hub. The attackers did not alter the core LiteLLM source code but instead modified the installation packages by inserting malicious files like 'cook.pth', 'cook.py', and 'sitecustomize.py' into the Python environment's library directory. These files were designed to execute automatically whenever Python or related tools were launched, ensuring the malware ran before the intended application.

What Data Was Exposed & Consumer Risks

• Cloud and deployment credentials: This includes sensitive information for cloud providers such as AWS, Azure, and Google Cloud, as well as Kubernetes, Docker, and other infrastructure management secrets.
• AI credentials and configuration: Authentication files for AI development tools, and any stored provider credentials or model settings within LiteLLM.
• Developer secrets and private keys: This encompasses credentials for Git, GitHub, npm, PyPI, and CI/CD systems, along with .env files, and private keys for SSH, GPG, and TLS.
• Browser data: The malware also targeted saved login credentials, cookies, autofill and payment information, and browsing history databases from affected browsers.
• Host and runtime data: Environment variables, shell and application histories, and general system and network information were also exfiltrated.

The compromised data was encrypted using AES-256-CBC and then further secured with an RSA-4096 key before being uploaded to a remote server. The primary risk to consumers, particularly developers and organizations using LiteLLM, is the severe compromise of their digital assets and infrastructure. Stolen cloud credentials can lead to unauthorized access and resource manipulation, while developer secrets can enable further attacks, code theft, or the introduction of more malware. Browser data theft can result in identity theft and financial fraud.

Protective Steps for Affected Consumers

Organizations and developers who may have used LiteLLM version 1.107.0 should take immediate action. It is crucial to stop affected deployments and thoroughly inspect development environments without launching the Python interpreter. Infected systems should be isolated and, ideally, rebuilt from clean backups. All exposed secrets, including API keys, passwords, and private keys, must be rotated immediately. Simply uninstalling the LiteLLM package is insufficient, as residual malicious files or active loaders may remain. The recommended safe version to revert to is LiteLLM 1.106.2, the last known clean release prior to the incident.