LiteLLM chorshanba kuni tahdidchilar "bir nechta mustaqil xavfsizlik nazoratlarini" buzib, Python paketining zararli versiyasini chiqarishganini ma'lum qildi. Bu versiya ma'lumot o'g'irlovchi va orqa eshikni o'z ichiga olgan.
2026-yil 21-oktabrda LiteLLMning chiqarish quvuri buzilib, 1.107.0 versiyasi Docker Hub registriga va Python Package Index (PyPI) omboriga joylashtirildi. Hodisa taxminan soat 4:00 da (PST) sodir bo'ldi. Quyidagi buzilgan versiyalar nashr etildi:
- LiteLLM v1.107.0 (PyPI)
- v1.107.0, latest, main-latest va main-stable (Docker)
- v1.107.0, latest, main-latest va main-stable (GHCR)
11:39 dan 13:23 gacha UTC orasida pip orqali LiteLLMning pinlanmagan versiyasini yuklab olgan yoki 11:46 dan 14:20 gacha UTC orasida Docker tasviri v1.107.0, latest, main-latest yoki main-stable dan foydalangan foydalanuvchilar ta'sirlangan.
Zaharlangan versiya ma'lumotlar va kalitlarni o'g'irlash, shuningdek har soatda masofaviy serverdan ixtiyoriy kodni ishga tushirish kodini o'z ichiga olgan bo'lib, bu uni masofaviy kirish troyaniga (RAT) aylantirgan.
Xususan, Python interpretatori "cook.pth" deb nomlangan yo'l faylini qayta ishlaydi, bu fayl "cook" ni import qilish buyrug'ini o'z ichiga oladi. "cook.py" deb nomlangan Python skripti o'zini deobfuskatsiya qiladi va "privcollect" deb nomlangan o'g'irlash tartibini ishga tushiradi, bu tizim, brauzer, dasturchi, bulut va AI vositalari sirlarini yig'adi va ma'lumotlarni "litellm[.]dev/healthcheck" ga HTTP POST so'rovi orqali yuboradi.
Bundan tashqari, interpretator "sitecustomize.py" ni bajarishga urinadi, bu faqat Linux va macOS mashinalarida ishlaydi va endi o'chirilgan GitHub dead drop ("github[.]com/letters9813") dan "domain.txt" ni olishga sozlangan. Agar bu fayl haqiqiy javob qaytarsa, zararli dastur ikkinchi bosqich Python skriptini "/codepy" dan yuklab oladi va bajaradi.
"U fon daemonini ishga tushiradi, bu '/tmp/remotecodeloader.lock' da blokirovka oladi va bir nechta nusxalarni oldini oladi, so'ngra cheksiz tsiklga kiradi," dedi Aikido tadqiqotchisi Ilyas Makari. "Har soatda daemon hujumchining joriy C2 domenini GitHub omboridan (raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt) oladi, so'ngra https://{domain}/codepy dan Python yuklamasini oladi va bajaradi."
Google'ga tegishli bulut xavfsizlik sho'ba korxonasi Wiz ma'lumotiga ko'ra, matn fayli GitHub tomonidan taxminan 13:30 UTC da o'chirilishidan oldin faqat dastlabki sinov qiymatlari bilan to'ldirilgan edi.
"Ikkala texnikani bir vaqtda ishlatish, .pth fayllari va sitecustomize.py ni birgalikda ishlatish, yovvoyi tabiatda hujjatlashtirilgan birinchi holatga o'xshaydi," dedi Wiz tadqiqotchilari Benjamin Read va Rami McCarthy.
Wiz ma'lumotiga ko'ra, o'g'irlangan ma'lumotlar ishlatilishi taxminan 4,5 soat o'tgach, 16:20 dan 17:01 gacha UTC orasida quyidagi IP manzillardan kuzatilgan:
- 168.100.8[.]57
- 165.227.201[.]8
"Har bir ma'lumot sts:GetCallerIdentity bilan tekshirildi, so'ngra bedrock:ListFoundationModels va ListModels chaqiruvi bilan, bu LLMjacking bilan mos keladi," deb qo'shdi Wiz. "Kam sonli muhitlarda hujumchi IAM (ListRoles, ListUsers, ListAccessKeys) ni ro'yxatga oldi va umumiy kashfiyot (ListAccounts, DescribeTrails va boshqalar) ni amalga oshirdi."
Chorshanba kuni e'lon qilingan maslahatnomada LiteLLM bu yilning mart oyida sodir bo'lgan shunga o'xshash hodisadan so'ng chiqarish quvurni mustahkamlaganini aytdi. Bu nashrlarni shaxsiy omborga ko'chirish, Docker nashr teglarini o'zgarmas qilish va Docker tasvirlarini imzolashni o'z ichiga olgan.
Biroq, ochiq manbali loyiha saqlovchilari vaqtincha nashr ruxsatlarini kengaytirib, ikki ichki muhandisga mijozlar uchun kundalik xatolik tuzatishlarini nashr etishga ruxsat berganidan so'ng, hujumchi uchta dasturchi GitHub CLI ma'lumotlariga kirishdan foydalanib, zararli versiyani chiqarishga muvaffaq bo'ldi.
Harakatlar ketma-ketligi quyidagicha:
- 2026-yil 19-oktabrda LiteLLM vaqtincha ikki ichki muhandis uchun nashr ruxsatlarini kengaytirdi.
- Hujumchi uchta dasturchi GitHub CLI ma'lumotlariga, jumladan GitHub ish oqimlarini ishga tushirish qobiliyatiga ega bo'lgan biriga kirish huquqiga ega edi.
- Hujumchi GitHub tashkilot egalaridan biriga tegishli tokenni ishlatib, filial himoyalarini o'chirib, zararli o'zgarishlarni majburan itarib yubordi.
- Hujumchi buzilgan ish oqimini ishga tushirib, uni "Berri-AI/litellm" deb nomlangan o'xshash omborga yo'naltirdi, bu "BerriAI/litellm" emas, natijada zaharlangan artefaktlar imzolandi va nashr etildi.
"To'liq tekshiruvdan so'ng, biz Claude Code foydalanuvchining GitHub CLI OAuth tokenini javob tanasiga joylashtiradigan aniq holatlarni kuzatdik va javob tanalari jurnallarda saqlanadigan holatlarda bu tokenlar LiteLLM jurnallarida paydo bo'lishi mumkin," dedi LiteLLM.
Saqlovchilar, shuningdek, ichki LiteLLM joylashtirishida "kutilmagan, zararsiz nomlangan foydalanuvchi hisobini" aniqladilar, bu umumiy internetga ochiq edi. Hujumchi bu joylashtirishga kirish huquqiga ega bo'lib, uning jurnallaridan GitHub CLI OAuth tokenlarini olgan va keyinchalik bu ma'lumotlardan nashr ish oqimini buzish uchun foydalangan deb gumon qilinmoqda.
Joylashtirish qanday qilib umumiy ochiq bo'lgani va hujumchi unga qanday kirish huquqiga ega bo'lgani hozircha aniq emas. Biroq, LiteLLM bu yaqinda tuzatilgan zaiflik orqali sodir bo'lgan deb taxmin qilmoqda.
".pth" faylidan o'g'irlash dasturini ishga tushirish usuli 2026-yil mart oyidagi TeamPCP ga tegishli hujumda kuzatilgan usulga o'xshaydi. Biroq, Socket The Hacker News ga bu bosqichda ikkita hodisani bog'lash uchun dalil yo'qligini aytdi.
"Hozirgacha ko'rib chiqilgan umumiy dalillar mart hujumi bilan bog'liqlikni tasdiqlamaydi," dedi Socket. "O'rnatilgan RSA ochiq kalitlari farq qiladi, shuningdek, ma'lumot yuborish amalga oshirilishi va orqa eshik xatti-harakatlari ham. Bu bir xil operator turli vositalardan foydalanayotganini inkor etmaydi, lekin biz bu bog'liqlikni qo'llab-quvvatlaydigan dalilga ega emasmiz. Mart oyida o'g'irlangan ma'lumotlar rol o'ynaganmi, bu ham tasdiqlanmagan."
Dasturchilarga LiteLLM 1.107.0 ni mashinalaridan o'chirish, zararli versiya o'rnatilgan xostlarni ajratish, zararli Python artefaktlarini qidirish, ma'lumot yuborish domeniga kirishni bloklash, barcha ma'lumotlarni aylantirish va "/codepy" bajarilishini tekshirish tavsiya etiladi.
"Bitta buzilgan o'rnatish hujumchiga zararli kodni pastga itarish qobiliyatini berishi mumkin," dedi JFrog xavfsizlik tadqiqotchisi Guy Korolevski. "Xavfsizlik jamoalari uchun dars shuki, toza manba ombori siz haqiqatan ham o'rnatadigan artefakt haqida kam ma'lumot beradi, shuning uchun aniq g'ildirakni tekshiring va versiyalarni qurilishga yetishdan oldin tekshiring. Agar 1.107.0 sizning muhitda ishlagan bo'lsa, har bir erishish mumkin bo'lgan ma'lumotni aylantiring va qayta quring."
Yangilanish
LiteLLM yangi yangilanishda shaxsiy registrdan tasvir oladigan korporativ mijozlar ta'sirlanmaganini aytdi va ta'sirlangan versiya (v1.107.0) nashr etilganidan 3 soat ichida o'chirilganini qo'shdi.
"Bizning darhol ustuvorligimiz mijozlar himoyalanganini ta'minlash va bu qayta sodir bo'lishining oldini olishdir," dedi Berri AI bosh direktori Krrish Dholakia. "Biz ildiz sabab tekshiruvini davom ettirmoqdamiz va nashr quvurni mustahkamlash uchun qiladigan aniq o'zgarishlarni ulashamiz."
Ta'minot zanjiri buzilishini tahlil qilishda Endor Labs tashkilotlarga buzilgan versiya bilan bog'liq artefaktlarni qidirish, ta'sirlangan xostlarni cheklash, ma'lumotlarni aylantirish, tarmoq jurnallarini skanerlash va konteyner tasvirlarini teg bo'yicha emas, digest bo'yicha pinlashni tavsiya qildi.
"Hujum butunlay qadoqlashda yashaydi va LiteLLMning ilova kodi o'zgarmagan," dedi xavfsizlik tadqiqotchisi Peyton Kennedy. "Maturin qurilish konfiguratsiyasiga qo'shilgan bitta qator, data = "cook", g'ildirakni o'rnatadigan har qanday muhitning Python kutubxona katalogiga uchta faylni joylashtiradi: cook.pth, cook.py va sitecustomize.py."
"Python .pth qatorlarini bajaradi va sitecustomize ni har bir ishga tushirishda import qiladi, shuning uchun yuklama bu muhitda har qanday Python ishga tushirishida ishga tushadi, ilova LiteLLM dan foydalanadimi yoki yo'qmi."
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor.
On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m. PST. The following compromised versions were published -
- LiteLLM v1.107.0 (PyPI)
- v1.107.0, latest, main-latest, and main-stable (Docker)
- v1.107.0, latest, main-latest, and main-stable (GHCR)
Users who downloaded an unpinned version of LiteLLM between 11:39 a.m. and 1:23 p.m. UTC via pip or used the Docker image v1.107.0, latest, main-latest, or main-stable between 11:46 a.m. and 2:20 p.m. UTC are impacted.
The poisoned version incorporated code to harvest credentials and keys, and run arbitrary code from a remote server every hour, turning it into a remote access trojan (RAT).
Specifically, the Python interpreter processes a path file ("cook.pth"), which includes a command to import "cook," a Python script ("cook.py") that deobfuscates itself and runs a stealer routine named "privcollect" to gather system, browser, developer, cloud, and AI tool secrets, and exfiltrate the data to "litellm[.]dev/healthcheck" via an HTTP POST request.
In addition, the interpreter attempts to execute "sitecustomize.py," which runs only on Linux and macOS machines, and is configured to fetch "domain.txt" from a now-removed GitHub dead drop ("github[.]com/letters9813"). Should this file return a valid response, the malware proceeds to download a second-stage Python script from "/codepy" and execute it.
"It forks a background daemon that acquires a lock at '/tmp/remotecodeloader.lock' to prevent multiple instances, then enters an infinite loop," Aikido researcher Ilyas Makari said. "Every hour, the daemon fetches the attacker's current C2 domain from a GitHub repository (raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain[.]txt), then fetches and executes a Python payload from https://{domain}/codepy."
According to Google-owned cloud security subsidiary Wiz, the text file was only populated with initial test values prior to its takedown by GitHub around 1:30 p.m. UTC.
"The dual-technique approach, using both .pth files and sitecustomize.py simultaneously, appears to be the first documented case in the wild," Wiz researchers Benjamin Read and Rami McCarthy said.
Wiz said it has since observed abuse of stolen credentials, starting about 4.5 hours post-exfiltration, with the attacker validating AWS instance role credentials captured from compromised CI runners and Kubernetes nodes from the following IP addresses between 4:20 p.m. and 5:01 p.m. UTC -
- 168.100.8[.]57
- 165.227.201[.]8
"Each credential was checked with sts:GetCallerIdentity, followed by bedrock:ListFoundationModels and a ListModels call, consistent with LLMjacking," Wiz added. "In a small number of environments, the attacker also enumerated IAM (ListRoles, ListUsers, ListAccessKeys) and performed general discovery (ListAccounts, DescribeTrails, etc.)."
In an advisory published Wednesday, LiteLLM said it had hardened its release pipeline following a similar incident that took place earlier this March. This included moving releases to a private repository, making Docker release tags immutable, and signing Docker images.
However, after the open-source project maintainers temporarily expanded release permissions to allow two internal engineers to publish daily bugfix backports for customers, the attacker leveraged their access to three sets of developer GitHub CLI credentials to ultimately push a malicious version.
The entire sequence of actions is below -
- On October 19, 2026, LiteLLM temporarily expanded release permissions for two internal engineers.
- The attacker had access to three sets of developer GitHub CLI credentials, including one that had the ability to run GitHub workflows.
- The attacker used a token belonging to one of its GitHub organization owners to disable branch protections and force-push the malicious changes.
- The attacker ran the compromised workflow, pointing it to a lookalike repository "Berri-AI/litellm" instead of "BerriAI/litellm," causing the poisoned artifacts to be signed and published.
"After a thorough investigation, we have observed specific situations in which Claude Code will embed a user's GitHub CLI OAuth token into a response body, and in situations where response bodies are logged, these tokens may appear in LiteLLM logs," LiteLLM said.
The maintainers said they also identified an "unexpected, innocuously named user account" in its internal LiteLLM deployment that was exposed to the public internet. It's suspected that the attacker gained access to this deployment, obtained the GitHub CLI OAuth tokens from its logs, and subsequently used those credentials to compromise the release workflow.
It's currently unclear how the deployment became publicly accessible and how the attacker obtained access to it. However, LiteLLM has theorized that it was likely through a recently patched vulnerability.
The use of a ".pth" file to launch the stealer program is notable as it mirrors the modus operandi observed in the March 2026 attack attributed to TeamPCP. However, Socket told The Hacker News that there is no evidence at this stage to link the two incidents.
"The public evidence reviewed so far doesn't establish a connection to the March attack," Socket said. "The embedded RSA public keys differ, as do the exfiltration implementation and backdoor behavior. That doesn’t rule out the same operator using different tooling, but we don't have evidence to support that attribution. Whether credentials stolen in March played a role also remains unverified."
Developers are advised to remove LiteLLM 1.107.0 from their machines, isolate hosts on which the malicious version was installed, hunt for the malicious Python artifacts, block access to the exfiltration domain, rotate all credentials, and investigate the execution of "/codepy."
"A single compromised install can hand an attacker the ability to push malicious code downstream," JFrog security researcher Guy Korolevski said. "The lesson for security teams is that a clean source repository tells you little about the artifact you actually install, so verify the exact wheel and vet versions before they reach a build. If 1.107.0 ran anywhere in your environment, rotate every reachable credential and rebuild."
Update
LiteLLM, in a new update, said enterprise customers pulling images from its private registry are not affected, adding that the impacted version (v1.107.0) was removed within 3 hours of release.
"Our immediate priority is ensuring customers are protected and preventing this from happening again," Berri AI CEO Krrish Dholakia said. "We're continuing our root cause investigation and will share the specific changes we're making to harden our release pipeline."
In an analysis of the supply chain compromise, Endor Labs urged organizations to hunt for artifacts related to the compromised version, contain affected hosts, rotate credentials, scan network logs, and pin container images by digest, not by tag.
"The attack lives entirely in packaging, and LiteLLM's application code is unmodified," security researcher Peyton Kennedy said. "One line added to the Maturin build configuration, data = "cook", places three files into the Python library directory of any environment that installs the wheel: cook.pth, cook.py, and sitecustomize.py."
"Python executes .pth lines and imports sitecustomize on every startup, so the payload fires on any Python launch in that environment, whether or not the application uses LiteLLM."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.