Attack Chain

While the specifics of the attack chain are not fully detailed in the source, a typical supply chain attack targeting PyPI packages involves the following steps:

1. Package Compromise: Threat actor gains unauthorized access to the Litellm PyPI account or the build environment.
2. Malicious Code Injection: The attacker injects malicious code into the setup.py or other relevant files within the Litellm package. This malicious code could be designed to execute upon installation.
3. Version Release: The compromised versions, 1.82.7 and 1.82.8, are released to PyPI, making them available for users to download and install.
4. Package Installation: Users unknowingly download and install the compromised Litellm package using pip, triggering the execution of the injected malicious code.
5. Initial Access: The malicious code may establish a reverse shell, download additional payloads, or perform other actions to gain initial access to the victim’s system.
6. Persistence: The attacker may establish persistence on the compromised system through various techniques, such as creating scheduled tasks or modifying startup scripts.
7. Data Exfiltration/Malware Deployment: Depending on the attacker’s objective, they may exfiltrate sensitive data, deploy ransomware, or perform other malicious activities.
8. Lateral Movement: The attacker may attempt to move laterally to other systems within the compromised network, escalating their access and expanding their reach.

Impact

The compromise of Litellm versions 1.82.7 and 1.82.8 could lead to widespread compromise of systems that use the package. The injected malicious code could enable attackers to steal sensitive information, deploy malware, or gain unauthorized access to victim systems. The number of affected users is estimated to be in the thousands. This incident highlights the risks associated with supply chain attacks targeting open-source software repositories.

Recommendation

• Immediately stop updating to Litellm versions 1.82.7 and 1.82.8.
• Revert to a known-good version of Litellm prior to 1.82.7.
• Analyze network connections for suspicious traffic originating from systems where the compromised Litellm versions were installed, using network connection logs.
• Monitor process creations for suspicious processes spawned from Python executables where Litellm is installed, using process creation logs and the Sigma rules provided below.
• Investigate systems where Litellm 1.82.7 or 1.82.8 were installed for any signs of compromise.
• Review the blog post at https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/ for further details on the compromise.