A malicious release of the LiteLLM library, which has recorded 23 million downloads per week, was published on the PyPI repository, along with the injection of malicious code into the official Docker image of the project. This is not the first such incident with LiteLLM — in March of this year, attackers published malicious releases after intercepting the maintainer's credentials. This time, the attackers posted version LiteLLM 1.107.0, which has embedded malicious code for organizing remote command execution, as well as searching for and sending credentials, keys, and access tokens.
The malicious code was inserted during the build process without compromising the git repository. After installation, the malicious code activates before importing LiteLLM through the installation of the cook.pth, cook.py, and sitecustomize.py files in the Python libraries directory. These files are executed each time Python is run in the system without any user action required.
Initially, Python runs the cook.pth file, which contains only one line 'import cook' to import the cook.py script that collects credentials. Next, the sitecustomize.py script is imported, which is used for the background loading of external code (the loading parameters are defined by the link 'raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt'). The malicious code in both scripts is compressed using zlib and encoded with Base64. An indicator of compromise may be the appearance of files '/tmp/.pc_once_*' and '/tmp/remote_code_loader.lock' in the system.
After activation, the cook.py file scans the connection parameters for cloud services, repositories, and continuous integration systems (AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub CLI, Vault, Terraform, Packer), developer accounts, Git connection settings, npm and PyPI settings, files with environment variables, private keys for SSH, PGP, and TLS, AI tool settings, browser databases with cookies, stored data and history, information about processes, and environment variables. The discovered data is encrypted using AES-256-CBC + RSA-4096 algorithms and sent in the form of a verification request to the site litellm.dev, created by the attackers.
Source: opennet.ru
