Popular AI Tool LiteLLM Hit by Supply Chain Attack That Steals Credentials and Opens a Backdoor

A software supply chain attack has compromised LiteLLM, a popular Python package, according to reports from SafeDep, Socket, StepSecurity and Upwind. The affected release is version 1.107.0, which was distributed through PyPI wheels and Docker images. PyPI has quarantined the package and the malicious Docker images have been removed.

LiteLLM's director of security, Oliver Jensen, said the malicious actions were carried out through three engineers' GitHub accounts, apparently using stolen GitHub CLI OAuth tokens. One account was used to trigger the release and another to approve it. The tokens involved have been revoked, but the company has not yet found how they were obtained, so it cannot rule out further access. It has removed all but one unaffected user from its GitHub organization and updated public registries to remove trusted links to that organization.

Analysis shows the malicious version can collect cloud credentials, private keys, browser data and authentication files for AI development tools. StepSecurity described a credential stealer calling itself privcollect, plus a second payload that runs a background process. That process checks a GitHub location every hour and runs whatever Python code the attacker provides. The malware starts as soon as Python launches, before LiteLLM is even imported, through a path file named cook.pth. The same behaviour was seen in an earlier LiteLLM compromise in March, linked to the TeamPCP supply chain attacks. The investigation is ongoing.