LiteLLM yangi ta'minot zanjiri hujumida buzib kirildi va zararli paketlar uning foydalanuvchilariga PyPI va Docker orqali tarqatildi.
Hodisa 21-oktabrda sodir bo'ldi va LLM provayderlari o'rtasida so'rovlarni yo'naltirish uchun mashhur ochiq manbali proksi — 1.107.0 versiyasini o'z ichiga oldi.
Zararli paketlar taxminan uch soat davomida onlayn bo'ldi va 49 000 martadan ortiq yuklab olingan deb baholanmoqda. Paketlar PyPI'dan o'chirildi, Docker Hub teglari va tasvir variantlari esa yo o'chirildi, yo toza artefaktlarga qayta yo'naltirildi.
[O'qing: 2500 tashkilot buzilishida LiteLLM emas, Trivy aybdor]
LiteLLM tekshiruvi natijalariga ko'ra, hujumchilar "bizning ichki LiteLLM joylashtirishimizda kutilmagan, zararsiz nomlangan foydalanuvchi hisob qaydnomasi" uchun GitHub CLI OAuth tokenlarini qo'lga kiritishgan, bu hisob qaydnomasi umumiy internetga ochiq bo'lgan.
Tokenlar ehtimol Claude Code tomonidan sizdirilgan, u ma'lum sharoitlarda ularni javob tanasiga joylashtirgan, bu esa LiteLLM loglariga yozilishi mumkin. Hujumchilar tokenlarni loglardan olishgan bo'lishi mumkin.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Biroq hujumchilar ichki joylashtirishga qanday kirganligi yoki yon tomonga harakat qilganligi hali ham noaniq, chunki ular uchta ishlab chiquvchi GitHub CLI ma'lumotlariga ega bo'lishgan, deb aytadi LiteLLM.
Hujumchilar buzilgan ma'lumotlardan foydalanib filial himoyalarini o'chirishgan, relizerni boshqa manba omboriga yo'naltiradigan o'zgarishni birlashtirishgan va soxta omborga ishora qiladigan buzilgan GitHub ish oqimini ishga tushirishgan, so'ngra zaharlangan artefaktlarni imzolab nashr etishgan.
Buzilish oynasi davomida zararli LiteLLM 1.107.0 versiyasini yuklab olgan foydalanuvchilar ma'lumot o'g'irlovchi va RAT (masofadan boshqarish vositasi) sifatida ishlaydigan zararli dastur bilan yuqtirilgan. LiteLLM ma'lumotiga ko'ra, uning shaxsiy omboridan yuklab olgan korporativ mijozlari ta'sirlanmagan.
Ehtimol AI yordamida yaratilgan va haqiqiy BerriAI/litellm omboriga o'xshash Berri-AI/litellm'dan tarqatilgan yuklama, Python interpretatori har safar ishga tushganda bajarilishi uchun site-packages ildiziga uchta faylni chiqaradi.
Avval interpretator o'g'irlovchini yuklaydi, u tizim ma'lumotlarini, brauzer ma'lumotlari va cookie'larini, ishlab chiquvchi ma'lumotlarini, muhit o'zgaruvchilarini, bulut sirlarini (AWS, GCP va Azure), AI vositalari API kalitlarini (Anthropic, GitHub Copilot, OpenAI va boshqalar), SSH shaxsiy kalitlarini, shell tarixi fayllarini va GPG kalitlarini yig'adi.
O'g'irlangan ma'lumotlar shifrlanadi va litellm[.]dev'ga yuboriladi.
Kiberxavfsizlik tashkiloti Wiz aytishicha, hujumchilar o'g'irlangan ma'lumotlarni sizdirishdan taxminan 4,5 soat o'tgach ulardan foydalanishni boshlashgan.
Wiz hujumchilarning o'g'irlangan AWS ma'lumotlari bilan Amazon Bedrock modellariga so'rov yuborayotganini kuzatgan, bu LLMjacking (LLM o'g'irlash) ni ko'rsatadi.
Zararli dastur RAT komponenti hujumchilarning buyruq-va-boshqaruv (C&C) serveri bilan muntazam tekshirib turishi kuzatilgan. U shuningdek "har soatda GitHub dead drop'ni tekshiradi va hujumchi taqdim etgan har qanday Python kodini ishga tushiradi", deb qayd etadi StepSecurity.
LiteLLM 1.107.0 versiyasini o'rnatgan foydalanuvchilar uni darhol o'chirishlari, ma'lumotlarini aylantirishlari (rotate) va tizimlarini zararli dastur uchun tekshirishlari kerak. Eng so'nggi toza LiteLLM versiyasi 1.106.2.
Bog'liq: AOMEI Backupper qisqa muddatli ta'minot zanjiri kampaniyasida buzib kirildi
Bog'liq: Rank Math PRO WordPress plagini ta'minot zanjiri hujumida buzib kirildi
Bog'liq: 86 million dollarlik kripto o'g'irligi Ledger Signer apparat implantiga bog'liq
Bog'liq: Uzoq muddatli NPM zararli dastur kampaniyasi 40 000 yuklab olishni to'pladi
Muallif: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
Eng so'nggi kiberxavfsizlik tahdidlari, tendentsiyalari va mutaxassis fikrlari uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Ionut Arghiredan ko'proq
PHP2Shell ekspluatatsiyasi yamoqlardan bir necha kun oldin boshlandi PHP2Shell yamoqlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda yetib keldi Xotira xatolari Chrome'ning 353 ta yangi xavfsizlik tuzatishlarining aksariyatini tashkil etadi Brauzerlar qayta tiklanadigan shaxsiy kalitlar tufayli eMudhra oraliq CA'larini bloklaydi Xitoy AI modeli AQSh pudratchisi uchun ekanligi aytilganda ko'proq buziladigan kod yozadi PHP2Shell: Sizdirilgan muhim PHP kamchiliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda AOMEI Backupper qisqa muddatli ta'minot zanjiri kampaniyasida buzib kirildi Ahold Delhaize kiberhujum natijasida buzilgan xizmatlarni tiklamoqda
So'nggi yangiliklar
Atlassian Data Center va Server mahsulotlaridagi 75 ta kamchilikni tuzatdi Eronning Prince of Persia APT'si 2016-yildan beri birinchi marta AQShda C&C joylashtirdi Xaker suhbatlari: Corey Thuen va Evil Bit Indurex sanoat kiberxavfsizlik platformasini kengaytirish uchun 8 million dollar yig'di Signal zaifligi zararli qo'ng'iroq qiluvchilarga qo'ng'iroqni to'xtatishni bloklashga imkon beradi Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob bermoqda Splunk, SolarWinds yangi xavfsizlik yangilanishlarini e'lon qildi Cisco bir nechta mahsulotlaridagi 34 ta zaiflikni tuzatdi
Trendda
PHP2Shell: Sizdirilgan muhim PHP kamchiliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda PHP2Shell yamoqlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda yetib keldi Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob bermoqda Xitoy AI modeli AQSh pudratchisi uchun ekanligi aytilganda ko'proq buziladigan kod yozadi Signal zaifligi zararli qo'ng'iroq qiluvchilarga qo'ng'iroqni to'xtatishni bloklashga imkon beradi Cisco bir nechta mahsulotlaridagi 34 ta zaiflikni tuzatdi PHP2Shell ekspluatatsiyasi yamoqlardan bir necha kun oldin boshlandi Google Chrome'ni ClickFix hujumlari va ishonchsiz HTTP ulanishlaridan qattiqroq himoya qiladi
Kundalik axborot byulleteni
Eng so'nggi tahdidlar, tendentsiyalar, texnologiya va soha mutaxassislarining chuqur fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Vebinar: Sizning Google Workspace'dagi AI kirish xavfi allaqachon mavjud
2026-yil 19-oktabr
Google Workspace'ga ulangan AI vositalari millionlab maxfiy elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramkani o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
2026-yil 10 va 11-noyabr
Amaliy tajribani baham ko'rish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun CISO'lar, yuqori darajali kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik yetakchilarini birlashtirgan holda qo'shiling.
Ro'yxatdan o'ting
Harakatdagi odamlar
Jon Steinbach Pentagon CIO'sining strategik texnik maslahatchisi etib tayinlandi.
Vasu Jakkal Armadin'ga CSBO sifatida qo'shildi.
Ivanti Robert Ruelasni CRO va Sterling Parkerni CCO etib tayinladi.
Harakatdagi odamlar haqida ko'proq
Mutaxassis fikrlari
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning ishlab chiquvchilaringiz AI qabul qilish shkalasida qayerda turishi xavfsizlik xavfini qanday hal qilishingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
LiteLLM was compromised in a fresh supply chain attack, and malicious packages were served to its users on both PyPI and Docker.
The incident occurred on October 21 and involved version 1.107.0 of the popular open source proxy for routing requests across LLM providers.
The malicious packages were online for roughly three hours and are estimated to have been downloaded over 49,000 times. The packages were removed from PyPI, and Docker Hub tags and image variants were either removed or repointed to clean artifacts.
[Read: Trivy, Not LiteLLM Behind the 2,500 Org Compromise ]
Per LiteLLM’s investigation, the attackers obtained the GitHub CLI OAuth tokens for “an unexpected, innocuously named user account in our internal LiteLLM deployment, which was exposed to the public internet”.
The tokens were likely leaked by Claude Code, which, in specific circumstances, would embed them into a response body, which may be logged to LiteLLM logs. The attackers likely retrieved the tokens from the logs.Advertisement. Scroll to continue reading.
However, it is still unclear how the attackers accessed the internal deployment or moved laterally, as they had access to three sets of developer GitHub CLI credentials, LiteLLM says.
The attackers used the compromised credentials to disable branch protections, merge a change that pointed the releaser to a different source repository, and run a compromised GitHub workflow that pointed to a lookalike repository, then signed and published the poisoned artifacts.
Users who downloaded the malicious LiteLLM version 1.107.0 packages during the compromise window were infected with malware that serves as an information stealer and a RAT. According to LiteLLM, its enterprise customers pulling from its private repository were not affected.
Likely built with the help of AI and served from Berri-AI/litellm, which poses as the legitimate BerriAI/litellm repository, the payload extracts three files into the site-packages root to be executed whenever a Python interpreter runs.
First, the interpreter loads the stealer, which harvests system information, browser credentials and cookies, developer credentials, environment variables, cloud secrets (AWS, GCP, and Azure), AI tool API keys (Anthropic, GitHub Copilot, OpenAI, and more), SSH private keys, shell history files, and GPG keys.
The stolen data is encrypted and sent to litellm[.]dev.
Cybersecurity outfit Wiz says the attackers started abusing the stolen credentials roughly 4.5 hours after they were exfiltrated.
Wiz observed the attackers querying Amazon Bedrock models with stolen AWS credentials, suggesting LLMjacking.
The RAT component of the malware was observed regularly checking with the attackers’ command-and-control (C&C) server. It also “checks a GitHub dead drop every hour and runs whatever Python the attacker serves,” StepSecurity notes.
Users who installed LiteLLM version 1.107.0 should immediately remove it, rotate their credentials, and sweep their systems for malware. The most recent clean LiteLLM version is 1.106.2.
Related: AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign
Related: Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Related: $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant
Related: Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Written By Ionut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Ionut Arghire
PHP2Shell Exploitation Started Days Before Patches PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors Memory Bugs Account for Most of Chrome’s 353 New Security Fixes Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign Ahold Delhaize Restoring Services Disrupted by Cyberattack
Latest News
Atlassian Patches 75 Flaws in Data Center and Server Products Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 Hacker Conversations: Corey Thuen and the Evil Bit Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform Signal Vulnerability Lets Malicious Callers Block Hang-Ups Tech and Security Companies Respond to PHP2Shell Vulnerabilities Splunk, SolarWinds Release Fresh Security Updates Cisco Patches 34 Vulnerabilities Across Multiple Products
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Cisco Patches 34 Vulnerabilities Across Multiple Products
PHP2Shell Exploitation Started Days Before Patches
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)