The developers of the Python library LiteLLM, which has 95 million downloads per month and 3.5 million in the last 24 hours, reported a compromise of the project. Attackers managed to intercept the maintainer's credentials and publish two malicious releases on PyPI — 1.82.7 and 1.82.8, containing code to steal keys and passwords from users' systems. Currently, the malicious versions have been removed from PyPI, and the project is temporarily frozen until the investigation is completed.
The access token for the LiteLLM account on PyPI fell into the hands of attackers due to the use of the dependency security scanner trivvy in the continuous integration system. Previously, at the end of February, attackers gained access to the Trivy project infrastructure by exploiting a vulnerability in the pull_request_target handler, which runs in the Trivy continuous integration system. After the compromise, the attackers published malicious releases of Trivy 0.69-0.69, replaced the GitHub Action handler trivy-action, and uploaded a modified Docker image with Trivy.
On March 24 at 11:30 AM (MSK), the intercepted credentials of the LiteLLM maintainer (krrishdholakia) were used for the direct publication of the malicious releases LiteLLM 1.82.7 and 1.82.8 on PyPI, bypassing the official GitHub CI/CD. The project repository on GitHub was unaffected — malicious activity was observed only on PyPI. In the LiteLLM 1.82.7 release, the malicious code was embedded in the file litellm/proxy/proxy_server.py and activated upon importing litellm.proxy. In the 1.82.8 release, a file site-packages/litellm_init.pth was included, and a handler was added to the proxy_server.py file, packed in base64 format and activated on any launch.
The added malicious code scanned and sent confidential data. It sent found SSH and SSL/TLS keys, the contents of environment variables, credentials for AWS, GCP, Azure, and K8s, keys from cryptocurrency wallets, database passwords, command line interpreter operation history, configuration files from Git, CI/CD, package managers, and Docker. The detected data was encrypted using the AES-256-CBC + RSA-4096 algorithms and sent via HTTP POST request to the site "https://models.litellm.cloud/" (domain litellm.cloud was registered just a few hours before the publication of the malicious releases).
LiteLLM users are advised to ensure that the file litellm_init.pth is not present in the site-packages directory, update all keys and credentials if version 1.82.7 or 1.82.8 is installed, pin specific versions of LiteLLM in dependency loading parameters, and verify the versions of LiteLLM being used against the release code on GitHub.
Source: opennet.ru
