LiteLLM Supply Chain Compromise Exposes AI Developer Credentials to Malware Attacks

LiteLLM 1.107.0 versiyasi ta'minot zanjiri hujumida buzildi va PyPI g'ildiraklari hamda konteyner rasmlari orqali ma'lumot o'g'irlovchi zararli dasturlar tarqatildi.

2026-yil 21-oktabrda Socket tadqiqotchilari xabar berishicha, zararli Python ishga tushirish ilgaklari hatto ilovalar LiteLLM ni import qilmasa ham faollashishi mumkin edi, bu esa bulut ma'lumotlari, ishlab chiquvchi sirlarini va AI autentifikatsiya fayllarini fosh qilishi mumkin.

Socket nashr etilgandan taxminan yetti daqiqa o'tib yettita zararli g'ildirakni belgiladi; ta'sirlangan tarqatmalar macOS, Linux va Windows ni qamrab oladi.

LiteLLM — katta til modellari provayderlari uchun keng tarqalgan interfeys va proksi — haftasiga taxminan 23 million marta yuklab olinadi, bu esa buzilgan nashr sezgir ishlab chiqarish va ishlab chiquvchi ma'lumotlariga yaqin bo'lganini anglatadi.

LiteLLM Ta'minot Zanjiri Buzildi

Konteyner qurilish manbasi Berri-AI/litellm ni manba sifatida qayd etgan, haqiqiy BerriAI/litellm ombori o'rniga. BerriAI/project-releaser shaxsiy ish oqimi manba egasi o'zgartirilishini qayd etgan, bu esa chiziqcha bilan yozilgan tashkilotni tanlagan. Ko'rsatilgan reviziyadagi yuk fayllari PyPI g'ildiragida topilgan fayllarga mos kelgan.

Qurilish o'zgarishlari Maturin konfiguratsiyasiga data = "cook" qatorini qo'shgan va zararli katalogni Docker qurilish bosqichlariga nusxalagan. Biroq, dalillar o'zgartirish qanday ruxsat etilganini, hisob yoki token buzilganini, yoki bu ish oqimi g'ildiraklarni nashr etganini aniqlamaydi.

Kuzatuv paytida konteyner teglari v1.107.0, latest, main-latest va main-stable barchasi bir xil rasm indeksiga ishora qilgan, bu esa ta'sirni aniq versiyalangan joylashtirishlardan tashqariga kengaytirgan.

G'ildiraklar cook.pth, cook.py va sitecustomize.py fayllarini Python kutubxona katalogiga o'rnatadi. Ishga tushirish ilgagi bitta bajariladigan qatorni o'z ichiga oladi:

import cook Bu qator standart interpretator ishga tushirishida kollektorni faollashtiradi. Natijada, ta'sirlangan muhitda Python yoki pip ni ishga tushirish zararli dasturni qayta faollashtirishi mumkin, bu esa odatiy tekshiruvni potentsial xavfli qiladi.

Dekodlangan privcollect yuklamasi AWS, Azure, Google Cloud, Kubernetes, SSH kalitlari, brauzer ma'lumotlar bazalari, muhit o'zgaruvchilari va ishlab chiquvchi konfiguratsiya fayllarini nishonga olgan 16 ta to'plam modulini yoqadi. AI ga xos nishonlar Codex, Claude, Gemini, Cursor va boshqa yordamchilarni o'z ichiga oladi.

Ma'lumotlar bazasi moduli LiteLLM jadvallaridan saqlangan ma'lumotlar va model sozlamalarini olishga urinadi. Biroq, alohida joylashtirishlardan muvaffaqiyatli o'g'irlik haqida dalil yo'q edi.

To'plangan JSON AES-256-CBC yordamida shifrlanadi, kalit esa RSA-4096-OAEP yordamida o'raladi. Natijaviy arxiv aldamchi /healthcheck nuqtasiga yuklanadi. Alohida, sitecustomize.py ajratilgan yuklovchini ishga tushiradi, u GitHub da joylashgan ko'rsatkichni o'qiydi va yuklab olingan Python fayllarini imzo yoki xesh tekshiruvisiz bajarishi mumkin.

Bir kuzatuv paytida ko'rsatkich bo'sh edi, bu yuklab olish bosqichini to'xtatdi, lekin mustaqil kollektorni o'chirmadi. Yuklovchi har soatda qayta urinadi, garchi bu har soatlik ma'lumot yuborilishini tasdiqlamasa ham.

IoC

Eslatma: IP manzillar va domenlar tasodifiy hal qilish yoki giperhavola qilishning oldini olish uchun ataylab defang qilingan (masalan, [.]). Faqat MISP, VirusTotal yoki SIEM kabi nazorat qilinadigan tahdid razvedka platformalarida qayta fang qiling.

Tashkilotlar nashrni bloklashi, rasm xeshlarini tekshirishi va Python o'rnatilgandan keyin ishlagan muhitlarni ajratishi kerak. Dalillarni ta'sirlangan interpretator emas, balki ishonchli vositalar yordamida saqlang.

Ko'rib chiqilgan artefaktlardan qayta qurish va potentsial fosh qilingan ma'lumotlarni toza tizimdan aylantirish kerak. LiteLLM ni o'chirish na ma'lumot fosh bo'lishini bekor qiladi, na mavjud yuklovchini to'xtatadi. Xizmat ko'rsatuvchilar ombor identifikatorlari, nashr ruxsatlari va nashr etilgan artefaktlarni tasdiqlangan manbalar bilan tekshirishlari kerak.

LiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images.

On October 21, 2026, researchers at Socket reported thatmalicious Python startup hooks could activate even if applications didn’t import LiteLLM, potentially exposing cloud credentials, developer secrets, and AI authentication files.

Socket flagged seven malicious wheels about seven minutes after publication; the affected distributions span macOS, Linux, and Windows.

LiteLLM, a common interface and proxy for large language model providers, receives about 23 million weekly downloads, which means the compromised release was close to sensitive production and development credentials.

LiteLLM Supply Chain Compromised

Container build provenance recorded Berri-AI/litellm as its source instead of the legitimate BerriAI/litellm repository. The private BerriAI/project-releaser workflow noted a source-owner override that selected the hyphenated organization. Payload files in the referenced revision matched those found in a PyPI wheel.

Build changes added the line data = “cook” to the Maturin configuration and copied the malicious directory into Docker build stages. However, the evidence does not clarify how the override was authorized, whether an account or token was compromised, or whether that workflow published the wheels.

At the time of observation, container tags v1.107.0, latest, main-latest, and main-stable all resolved to the same image index, which extended exposure beyond explicitly versioned deployments.

The wheels install cook.pth, cook.py, and sitecustomize.py into Python’s library directory. The startup hook contains a single executable line:

import cook This line activates the collector during standard interpreter initialization. As a result, starting Python or pip in an affected environment can reactivate the malware, making routine inspection potentially hazardous.

The decoded privcollect payload enables 16 collection modules targeting AWS, Azure, Google Cloud, Kubernetes, SSH keys, browser databases, environment variables, and developer configuration files. AI-specific targets include Codex, Claude, Gemini, Cursor, and other assistants.

A database module attempts to retrieve saved credentials and model settings from LiteLLM tables. However, there was no evidence of successful theft from individual deployments.

The collected JSON is encrypted using AES-256-CBC, with its key wrapped using RSA-4096-OAEP. The resulting archive is uploaded to a deceptive /healthcheck endpoint. Separately, sitecustomize.py launches a detached loader that reads a GitHub-hosted pointer and can execute downloaded Python files without signature or hash verification.

During one observation, the pointer was empty, which prevented that download phase but did not disable the independent collector. The loader retries hourly, although this does not confirm hourly exfiltration.

IoC

Note:IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Organizations should block the release, inspect image digests, and isolate environments where Python ran after installation. Preserve evidence using trusted tooling rather than the affected interpreter.

Rebuild from reviewed artifacts and rotate potentially exposed credentials from a clean system. Removing LiteLLM alone neither reverses credential exposure nor stops an existing loader. Maintainers should validate repository identities, release permissions, and published artifacts against approved sources.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.