LiteLLM Supply Chain Attack Exposes Apps to Credential Theft

In a significant software supply chain compromise, attackers injected malicious code into LiteLLM version 1.107.0, a widely-used Python library that provides unified interfaces for large language model APIs. Security researchers from SafeDep, Socket, StepSecurity, and Upwind identified that the compromised package was distributing both credential-stealing malware and persistent backdoors to unsuspecting developers.

The breach specifically targeted the package's distribution mechanisms, affecting both PyPI wheel packages and official Docker images. With over 100,000 weekly downloads, LiteLLM's popularity means the potential impact spans numerous production applications that rely on AI integration for business operations.

Attack Vector and Distribution

• Attackers compromised the build or release process for LiteLLM 1.107.0
• Malicious code was embedded in official PyPI wheels and Docker images
• Compromised package versions have been removed from public repositories
• Automated dependency updates likely accelerated the spread within organizations
• Initial compromise window remains under investigation by maintainers

Security Impact and Response

• Deployed malware includes credential harvesting tools targeting environment variables
• Backdoor functionality allows persistent remote access to affected systems
• Organizations using LiteLLM in production should treat systems as potentially compromised
• Security teams must audit all API keys, tokens, and secrets exposed to affected environments
• Developers should verify package integrity using signed releases when available

Sources

• LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor