LiteLLM 1.107.0 Supply Chain Attack: Malicious PyPI Packages and Docker Images Steal Credentials

LiteLLM has confirmed that on October 21, attackers took over its release pipeline and used it to push a malicious version 1.107.0 through PyPI and container registries. StepSecurity separately confirmed that the release contained code that steals credentials and lets the attackers run more code of their choosing.

What has been confirmed

StepSecurity found malicious files in all seven prebuilt installation packages (wheels) and in the official container images. Simply starting the Python interpreter could trigger the malicious code. The environment did not need to import LiteLLM directly.

The vendor confirmed that the attackers used the credentials of three engineers. In an update posted at 20:30 UTC, it said it suspects the GitHub CLI tokens were taken from the logs of an internal LiteLLM deployment. It had not yet confirmed how the attackers got into that deployment.

Who is affected

Check any environment running litellm==1.107.0 and any images tagged v1.107.0, latest, main-latest or main-stable. Because floating tags can point to different images over time, compare them against the digests of the images you actually pulled. According to the vendor, the private enterprise registry was not affected, and the official source code tag on GitHub did not contain the malicious files.

What to do now

• Isolate suspect environments and preserve the evidence.
• Do not run Python or pip in an infected environment until you have removed the persistence mechanisms that run the malicious code automatically.
• From a clean device, revoke and replace any keys and tokens that may be compromised.
• Rebuild environments from trusted sources and review how the exposed credentials have been used.

SecurHUB commentary

The investigation should also cover any services that the stolen keys could reach. Incident response helps you establish the scope of the breach and decide the order in which to restore your environment.

Sources: LiteLLM, StepSecurity