LiteLLM Suffers Second Supply Chain Attack, Malicious Code Steals Cloud and AI API Keys
LiteLLM, a popular open-source tool for simplifying LLM API calls, has been compromised by a second supply chain attack this year, with a malicious version distributed via PyPI and Docker containing malware designed to steal cloud credentials and AI API keys.
LiteLLM, a widely used open-source project that simplifies interactions with various large language models (LLMs), has fallen victim to a second supply chain attack this year. A malicious release, version 1.107.0, was pushed to the Python Package Index (PyPI) and Docker registries on Wednesday, October 21st, containing malware specifically engineered to harvest cloud credentials, developer secrets, and API keys for AI services.
This incident follows a previous, significant supply chain compromise in March, which resulted in the exfiltration of a massive 153GB archive. That earlier breach impacted thousands of corporate domains, including major tech companies like AWS, Samsung, Cisco, and Salesforce, highlighting the pervasive risk of compromised software dependencies.
The compromised LiteLLM package was available on PyPI between 11:39 and 13:23 UTC and on Docker from 11:46 to 14:20 UTC. Security researchers emphasized that all versions prior to 1.107.0 are safe, and the affected releases have since been removed. However, users who installed the malicious version are strongly advised to treat all their credentials as compromised and rotate them immediately, even if they have since updated to a safe version.
According to LiteLLM's incident report, the attackers gained access to the project's release pipeline by compromising the GitHub accounts of three engineers. This was allegedly achieved using stolen GitHub CLI OAuth tokens, which were likely obtained from an internal LiteLLM deployment that was inadvertently exposed to the public internet. One compromised account was used to initiate the malicious release, another to approve it, and a third to delete workflow logs, thereby limiting the available forensic evidence.
The malware embedded within the compromised release is designed to run whenever Python starts in an affected environment, even if the LiteLLM library itself is not actively being used. This persistence mechanism allows it to steal a wide range of sensitive information, including credentials for cloud providers like AWS, Azure, and Google Cloud, Kubernetes and Docker secrets, Git credentials, SSH and GPG keys, saved browser logins and cookies, and shell history. It also targets authentication files for AI models and attempts to extract stored credentials from LiteLLM proxy deployments.
Security researchers from Wiz have confirmed that the stolen credentials are being actively weaponized. Within hours of the data exfiltration, attackers began validating AWS credentials from compromised systems, attempting to access AI models on Amazon Bedrock. In some instances, they proceeded to list IAM roles, users, and access keys, and to probe account and logging details, a tactic researchers refer to as "LLMjacking."
LiteLLM is currently conducting an ongoing investigation to identify the exact method of initial access to their internal deployment, suspecting a recently patched vulnerability. The company has stated that the incident is contained and is working to revoke or rotate all authentication tokens across its organization. Enterprise customers utilizing LiteLLM's private registry were reportedly unaffected by this breach.
With an estimated 23 million weekly downloads, the compromise of LiteLLM poses a significant risk to a broad user base. This incident underscores the critical importance of robust supply chain security practices, including stringent access controls, continuous monitoring of build pipelines, and prompt credential rotation following any suspected compromise.