LiteLLM 1.107.0 supply-chain poisoning exposed; affected packages and images have been taken down

AT A GLANCE

According to the report,LiteLLM 1.107.0 installation packages and Docker images were implanted with malware capable of stealing credentials and remotely executing code.

Article

LiteLLM Second poisoning incident this year: private keys can be stolen without making a call

Beating AI news: security company JFrog has found that the popular open-source AI model gateway LiteLLM has once again suffered a supply-chain attack. Its latest 1.107.0 version was implanted with malware, and the official Docker image was also affected.LiteLLM can provide unified access to models such as OpenAI and Anthropic and centrally manage API keys. Earlier this year,March was poisoned in another supply-chain attack.

This attack is more covert. Hackers concealed additional files in the Python installation package. After installation, malicious code runs automatically as soon as the relevant Python environment is started, even without calling LiteLLM. It collects browser passwords,SSH private keys,AWS and other cloud-platform credentials, as well as authentication information for development tools such as Claude, Codex, and Cursor. It also attempts to read model LiteLLM keys stored in the API database and send them to a server masquerading as an official domain.

The attackers also left a persistent backdoor that checks for remote commands every hour and, when necessary, downloads and executes new code. More troublingly, the official release source code on GitHub did not contain these malicious files, but installation packages published to all platforms on PyPI were trojanized. Through Docker build records, the community discovered that the source-code address used by the release system pointed to an impersonation repository whose name differed from the official repository by only a hyphen. How it entered the release process remains unclear.

At present,PyPI has removed the malicious version, and Docker Hub has also taken down the affected image. JFrog advises users who installed or ran 1.107.0 to treat relevant credentials as potentially compromised, isolate and rebuild their environments, and rotate sensitive credentials such as API keys, rather than simply uninstalling the software. The confirmed safe rollback version is 1.106.2.

Original link https://m.theblockbeats.info/flash/373048

Key points

Security company JFrog found that LiteLLM 1.107.0 was subject to a supply-chain attack, and the official Docker image was also affected.
According to the report, the malware was hidden in additional files in the Python installation package and can be triggered by starting the relevant Python environment, without calling LiteLLM。
The malicious code collects browser passwords,SSH private keys, cloud-platform credentials, and development-tool authentication information, and attempts to read model LiteLLM keys in the API database.
The persistent backdoor left by the attackers checks for remote commands every hour and can download and execute new code.
The official release source code on GitHub did not contain the relevant malicious files, but installation packages published to platforms on PyPI were all trojanized.
Docker build records show that the source-code address used by the release system pointed to an impersonation repository whose name differed from the official repository by only a hyphen.
PyPI has removed the malicious version, and Docker Hub has taken down the affected image.
JFrog recommends that users who installed or ran 1.107.0 isolate and rebuild their environments and rotate sensitive credentials such as API keys; the report says the confirmed safe rollback version is 1.106.2。

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

This is a software supply-chain attack:LiteLLM 1.107.0 installation packages or images obtained by users from release platforms may contain malicious code. The danger is that the code can run automatically when the relevant Python environment starts, without users actually calling LiteLLM. Simply uninstalling may not eliminate credentials that have already been compromised or any backdoors left behind, so the report recommends rebuilding the environment and replacing sensitive credentials.

Why it matters to readers

LiteLLM centrally manages model API keys, and affected environments may also store browser passwords,SSH private keys, cloud-platform credentials, and development-tool authentication information. If this information is sent to attackers, the related accounts and services may face unauthorized access.

If you installed or ran LiteLLM 1.107.0, you should treat sensitive credentials in the relevant environment as potentially compromised and, following the report's recommendations, isolate and rebuild the environment and rotate keys; those who have not used this version can also check the version and installation source.

Risks and unknowns

LiteLLM 1.107.0 entered the release process remains unclear.
The materials do not provide links to the original security advisories from JFrog,LiteLLM、PyPI or Docker Hub; the relevant conclusions are primarily based on the reports provided.
The materials do not specify the actual number of victims, whether credentials have been abused, or the scope of the attack's impact.

LiteLLM 1.107.0 supply-chain poisoning exposed; affected packages and images have been taken down

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center