LiteLLM: Supply chain compromise of version 1.107.0

LiteLLM version 1.107.0 was identified as malicious, having been distributed via PyPI and Docker images containing unauthorized code. The compromise occurred through the theft of GitHub CLI OAuth tokens belonging to three project engineers, which allowed the threat actor to trigger and approve a malicious release. All affected tokens have been revoked, and the organization is currently migrating to a more secure account management structure.

Attack Chain

1. Threat actor obtains GitHub CLI OAuth tokens belonging to three project engineers.
2. Threat actor uses one compromised account to trigger a project-releaser run.
3. Threat actor uses a second compromised account to approve the malicious release.
4. Malicious LiteLLM 1.107.0 package is published to PyPI and Docker Hub.
5. User installs or updates the malicious LiteLLM package.
6. Python interpreter loads the malicious 'cook.pth' file upon startup.
7. 'cook.pth' triggers the 'privcollect' payload to harvest cloud tokens, keys, and browser data.
8. Background daemon checks a GitHub-hosted dead drop for further instructions and executes returned Python code.

Impact

Successful exploitation results in the unauthorized exfiltration of cloud credentials, SSH private keys, browser data, and authentication files for various AI development tools. Collected data is exfiltrated as a GZIP-compressed TAR archive via HTTP POST requests to 'litellm.dev/healthcheck'.

Recommendation

• Pin dependencies to version 1.106.2 using cryptographic digests to prevent accidental installation of compromised versions.
• Review all environments where LiteLLM 1.107.0 was installed for signs of credential harvesting or persistent backdoors.
• Revoke and rotate all cloud credentials, API keys, and certificates present on systems that ran version 1.107.0.
• Monitor Python environments for the presence of files named 'cook.pth' or usage of the 'cook' module, which are indicative of this specific malware.
• Implement supply chain security practices such as ephemeral build environments and restricted permissions for GitHub CLI tokens used in automated release pipelines.