W repozytorium PyPI wykryto z\u0142o\u015bliw\u0105 wersj\u0119 biblioteki LiteLLM, kt\u00f3ra ma 23 miliony pobra\u0144 tygodniowo, a tak\u017ce z\u0142o\u015bliwy kod w oficjalnym obrazie Dockera projektu. To nie pierwszy taki incydent z LiteLLM \u2014 w marcu tego roku napastnicy ju\u017c publikowali z\u0142o\u015bliwe wersje po przej\u0119ciu danych uwierzytelniaj\u0105cych maintenancera. Tym razem napastnicy umie\u015bcili wersj\u0119 LiteLLM 1.107.0, w kt\u00f3rej wbudowano z\u0142o\u015bliwy kod do zdalnego wykonywania polece\u0144, a tak\u017ce wyszukiwania i wysy\u0142ania danych uwierzytelniaj\u0105cych, kluczy i token\u00f3w dost\u0119pu.<\/p>\n
Z\u0142o\u015bliwy kod zosta\u0142 wstrzykni\u0119ty na etapie procesu budowy bez kompromitacji repozytorium git. Po zainstalowaniu z\u0142o\u015bliwy kod aktywuje si\u0119 przed importem LiteLLM przez instalacj\u0119 plik\u00f3w cook.pth, cook.py i sitecustomize.py w katalogu z bibliotekami Pythona. Pliki te s\u0105 uruchamiane przy ka\u017cdym wykonaniu Pythona w systemie bez konieczno\u015bci podejmowania jakichkolwiek dzia\u0142a\u0144 przez u\u017cytkownika. <\/p>\n
Na pocz\u0105tku Python uruchamia plik cook.pth, w kt\u00f3rym znajduje si\u0119 tylko jedna linia \u201eimport cook\u201d do importowania skryptu cook.py, zbieraj\u0105cego dane uwierzytelniaj\u0105ce. Nast\u0119pnie za\u0142adowany jest skrypt sitecustomize.py, u\u017cywany do pobierania zewn\u0119trznego kodu (parametry pobierania okre\u015blone s\u0105 pod linkiem \u201eraw.githubusercontent.com\/letters9813\/pythonclient-test\/main\/domain.txt\u201d). Z\u0142o\u015bliwy kod w obu skryptach jest skompresowany za pomoc\u0105 zlib i zakodowany metod\u0105 Base64. Wska\u017anikiem kompromitacji mo\u017ce by\u0107 pojawienie si\u0119 w systemie plik\u00f3w \u201e\/tmp\/.pc_once_*\u201d i \u201e\/tmp\/remote_code_loader.lock.\u201d<\/p>\n
Po aktywacji plik cook.py skanuje parametry po\u0142\u0105czenia do us\u0142ug w chmurze, repozytori\u00f3w i system\u00f3w ci\u0105g\u0142ej integracji (AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub CLI, Vault, Terraform, Packer), kont deweloper\u00f3w, parametry po\u0142\u0105cze\u0144 z Git, ustawienia npm i PyPI, pliki z zmiennymi \u015brodowiskowymi, klucze prywatne do SSH, PGP i TLS, ustawienia narz\u0119dzi AI, bazy danych przegl\u0105darkowych z Cookie, przechowywane dane i historia, informacje o procesach i zmiennych \u015brodowiskowych. Wykryte dane s\u0105 szyfrowane przy u\u017cyciu algorytm\u00f3w AES-256-CBC + RSA-4096 i wysy\u0142ane w formie \u017c\u0105dania kontrolnego na stron\u0119 litellm.dev, utworzon\u0105 przez przest\u0119pc\u00f3w. \u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 PyPI \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LiteLLM, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 23 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 Docker-\u043e\u0431\u0440\u0430\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430. \u042d\u0442\u043e \u043d\u0435 \u043f\u0435\u0440\u0432\u044b\u0439 \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0439 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442 \u0441 LiteLLM — \u0432 \u043c\u0430\u0440\u0442\u0435 \u044d\u0442\u043e\u0433\u043e \u0433\u043e\u0434\u0430 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0430 \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u043e\u043f\u0440\u043e\u0432\u043e\u0436\u0434\u0430\u044e\u0449\u0435\u0433\u043e. \u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0440\u0430\u0437\u043c\u0435\u0441\u0442\u0438\u043b\u0438 \u0432\u0435\u0440\u0441\u0438\u044e LiteLLM 1.107.0, \u0432 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183962","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Z\u0142o\u015bliwe oprogramowanie w pakiecie PyPI i obrazie Docker z LiteLLM | ProHoster","description":"W PyPI zarejestrowano z\u0142o\u015bliwe wydanie biblioteki LiteLLM, kt\u00f3ra osi\u0105gn\u0119\u0142a 23 miliony pobra\u0144 tygodniowo, a tak\u017ce wstawiono z\u0142o\u015bliwy kod do oficjalnego obrazu Docker projektu.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/malware-injected-into-litellm-pypi-package-and-docker-image","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 PyPI-\u043f\u0430\u043a\u0435\u0442 \u0438 Docker-\u043e\u0431\u0440\u0430\u0437 \u0441 LiteLLM \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 \u041f\u041e | ProHoster","og:description":"\u0417\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044f \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 PyPI \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0430 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 LiteLLM, \u043d\u0430\u0441\u0447\u0438\u0442\u044b\u0432\u0430\u044e\u0449\u0435\u0439 23 \u043c\u043b\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a \u0432 \u043d\u0435\u0434\u0435\u043b\u044e, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0432 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 Docker-\u043e\u0431\u0440\u0430\u0437 \u043f\u0440\u043e\u0435\u043a\u0442\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/malware-injected-into-litellm-pypi-package-and-docker-image","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-10-22T15:40:40+00:00","article:modified_time":"2026-10-22T15:40:45+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/183962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=183962"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/183962\/revisions"}],"predecessor-version":[{"id":183963,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/183962\/revisions\/183963"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=183962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=183962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=183962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
\u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"