A Python library LiteLLM, which has 95 million downloads per month and 3.5 million in the last 24 hours, has been compromised, according to its developers. Attackers managed to intercept the maintainer's credentials and published two malicious releases in PyPI — 1.82.7 and 1.82.8, containing code to steal users' keys and passwords. The malicious versions have currently been removed from PyPI, and the project has been temporarily frozen until the investigation is completed.
The access token for the LiteLLM account in PyPI fell into the hands of attackers due to the use of a dependency security scanner trivvy in the continuous integration system. Earlier in late February, attackers were able to access the Trivy project infrastructure by exploiting a vulnerability in the pull_request_target handler triggered in the Trivy continuous integration system. After the compromise, the attackers published malicious Trivy releases 0.69-0.69, replaced the GitHub Action handler trivy-action, and posted a modified Docker image with Trivy.
On March 24 at 11:30 AM (MSK), the intercepted credentials of LiteLLM's maintainer (krrishdholakia) were used for the direct publication of the malicious releases LiteLLM 1.82.7 and 1.82.8 in PyPI, bypassing the official GitHub CI/CD. The project's repository on GitHub was not affected — the malicious activity was observed only in PyPI. In the LiteLLM 1.82.7 release, the malicious code was embedded in the file litellm/proxy/proxy_server.py and was activated upon importing litellm.proxy. The 1.82.8 release included the file site-packages/litellm_init.pth, and a handler packed in base64 format was added to the proxy_server.py file, which was activated during any execution.
The added malicious code scanned and sent sensitive data. It sent the discovered SSH and SSL/TLS keys, the contents of environment variables, credentials to AWS, GCP, Azure, and K8s, cryptocurrency wallet keys, database passwords, command interpreter operation history, configuration files from Git, CI/CD, package managers, and Docker. The detected data was encrypted using AES-256-CBC + RSA-4096 algorithms and sent via an HTTP POST request to the site "https://models.litellm.cloud/" (domain litellm.cloud was registered a few hours before the publication of the malicious releases).
A LiteLLM felhasználóknak ajánlott ellenőrizniük, hogy a site-packages mappában ne legyen litellm_init.pth fájl, frissíteni minden kulcsot és hitelesítő adatot, ha a 1.82.7 vagy 1.82.8 verziót telepítették, rögzíteni a LiteLLM konkrét verzióit a függőségek betöltési paramétereiben, és összevetni a használt LiteLLM kiadásokat a GitHub kiadási kódjával.
Forrás: opennet.ru
