LiteLLM reliz quvuri buzib kirilib, ma'lumot o'g'irlovchi zararli dastur tarqatildi
Bill Toulas
2026-yil 22-oktabr
15:12
0
Xakerlar LiteLLM loyihasining PyPI paketini buzib kirishdi va ma'lumotlar, maxfiy kalitlar va muhit o'zgaruvchilarini o'g'irlovchi yuk bilan zararli Docker tasvirlarini e'lon qilishdi.
Ta'minot zanjiri hujumi LiteLLM 1.107.0 versiyasi uchun barcha PyPI g'ildiraklariga (.whl o'rnatish paketlari) ta'sir qildi va Windows, Linux hamda macOS tizimlariga ta'sir ko'rsatdi.
LiteLLM — bu ochiq kodli Python SDK va AI shlyuzi bo'lib, ilovalarga turli provayderlardan AI modellariga umumiy API orqali kirish imkonini beradi.
Bu juda mashhur loyiha bo'lib, GitHub'da 61 800 yulduzga ega, PyPI'da oyiga 92 million yuklab olinadi va NVIDIA, Netflix, AT&T va Okta kabi yirik kompaniyalar tomonidan ishlatiladi.
Loyiha ma'lumotiga ko'ra, reliz quvuri 21-oktabrda buzib kirilgan va tahdid aktori 1.107.0 versiyasini Docker registri va PyPI'ga joylashtirgan.
"Bu versiya kompilyatsiya qilingan zararli dastur o'z ichiga olgan bo'lib, u ma'lumotlarni o'g'irlaydi va masofadan kod bajarish vositalarini yuklaydi", — deb aytadi texnik xizmat ko'rsatuvchi, shuningdek, xususiy korporativ mijozlar ta'sirlanmaganini qo'shimcha qiladi.
Hodisa bo'yicha tahlilda texnik xizmat ko'rsatuvchi quyidagi LiteLLM artefaktlari hujumda ta'sirlanganini aytadi:
PyPI: litellm==1.107.0: barcha yettita g'ildirak, 11:39:51 dan 13:23 UTC gacha faol bo'lgan
Docker Hub: v1.107.0, latest, main-latest va main-stable: 11:46:56 dan 14:20 UTC gacha buzilgan tasvir indeksiga sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e ishora qilgan
GHCR: v1.107.0, latest, main-latest va main-stable: 11:46:56 UTC dan 13:51 UTC gacha mavjud bo'lmagan holatga keltirilguncha buzilgan tasvir indekslariga ishora qilgan
ghcr.io/berriai/litellm: sha256:1bbcb1443bc9… ghcr.io/berriai/litellm-database: sha256:c00f9d92c427… ghcr.io/berriai/litellm-non_root: sha256:7b00e91cd2fe…
Bir nechta ilova xavfsizligi kompaniyalari zararli LiteLLM versiyasi e'lon qilinganidan olti daqiqa o'tib hujumni aniqlashdi va yukni tahlil qilishdi.
Tadqiqotchilarning ma'lumotiga ko'ra, hujumchi LiteLLM ilova kodiga tegmagan va faqat o'rnatish paketini o'zgartirib, muhitning Python kutubxona katalogiga uchta zararli faylni (cook.pth, cook.py va sitecustomize.py) joylashtirgan.
"Oddiy ishga tushirish jarayonida Python bajariladigan .pth qatorlarini qayta ishlaydi va keyin sitecustomize'ni import qilishga urinadi", — deb tushuntiradi Socket tadqiqotchilari.
Endor Labs ta'kidlaydiki, bu usulda yuklar ilova har safar muhitda Python ishga tushirilganda ilovadan oldin bajariladi. Ta'sirlangan o'rnatishni tekshirish uchun Python yoki pip'ni ishga tushirish ham zararli dasturni faollashtirgan.
Zararli dastur quyidagi ma'lumotlarga qaratilgan:
Bulut va joylashtirish ma'lumotlari: AWS, Azure, Google Cloud, Kubernetes, Docker va infratuzilmani boshqarish maxfiy kalitlari.
AI ma'lumotlari va sozlamalari: AI ishlab chiqish vositalari uchun autentifikatsiya fayllari, shuningdek LiteLLM saqlangan provayder ma'lumotlari va model sozlamalari.
Ishlab chiquvchi maxfiy kalitlari va shaxsiy kalitlar: Git, GitHub, npm, PyPI va CI/CD ma'lumotlari; .env fayllari; SSH, GPG va TLS kalitlari.
Brauzer ma'lumotlari: Saqlangan kirish, cookie, avtomatik to'ldirish/to'lov va brauzer tarixi ma'lumotlar bazalari.
Xost va ish vaqti ma'lumotlari: Muhit o'zgaruvchilari, qobiq va ilova tarixi, tizim va tarmoq ma'lumotlari.
O'g'irlangan ma'lumotlar AES-256-CBC kaliti bilan shifrlanadi, bu kalit RSA-4096 kaliti bilan shifrlanadi va keyin 'litellm[.]dev/healthcheck' manziliga yuklanadi.
Zararli fayllardan biri — sitecustomize.py — har soatda GitHub'da joylashgan ko'rsatkichni tekshiradigan va tashqi serverdan Python'ni yuklab, xostda bajaradigan ajratilgan yuklovchini ishga tushiradi.
Zararli paketlar olib tashlangan, ammo ehtimol ta'sirlangan foydalanuvchilar ta'sirlangan joylashtirishlarni to'xtatishlari va Python interpretatorini ishga tushirmasdan muhitlarni tekshirishlari kerak.
Infektsiyalangan tizimlar ajratilishi va toza zaxira nusxalaridan qayta qurilishi, shuningdek, barcha ochiq maxfiy kalitlar darhol almashtirilishi kerak.
LiteLLM paket katalogini yolg'iz o'chirish ishga tushirish fayllari yoki faol yuklovchini qoldirishi mumkin.
Hozirda tavsiya etilgan tiklanish versiyasi LiteLLM 1.106.2 bo'lib, bu hujumdan oldingi so'nggi toza relizdir.
Avvalroq, loyiha mart oyida ham buzib kirilgan edi, o'shanda TeamPCP xakerlik guruhi LiteLLM CI/CD quvurida ishlatilgan Aqua Security'ning Trivy zaiflik skanerini buzib kirgandan so'ng PyPI'da zararli LiteLLM versiyalarini e'lon qilgan.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37 foizi bloklanadi.
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalangach, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnikadan texnikaga himoyalarni o'lchaydi.
Hisobotni oling
Tegishli maqolalar:
OVHcloud CLI GitHub'da ishlab chiquvchi maxfiy kalitlarini o'g'irlash uchun orqa eshik bilan e'lon qilindi
MacSync zararli dasturi yangi yuklarni yetkazish uchun umumiy iCloud taqvimlaridan foydalanadi
Soxta LastPass Authenticator GitHub repozitoriylari yangi Rapuncel ma'lumot o'g'irlovchisini tarqatadi
Dasturchilar registri infratuzilmasi zararli modullarni tarqatish uchun buzib kirildi
WordPress SEO plagini Rank Math veb-saytlarni orqa eshik bilan ta'minlash uchun buzib kirildi
LiteLLM release pipeline hacked to distribute info-stealer malware
By Bill Toulas
October 22, 2026
03:12 PM
0
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.
The supply-chain attack affected all PyPI wheels (.whl installation packages) for LiteLLM version 1.107.0, impacting Windows, Linux, and macOS systems.
LiteLLM is an open-source Python SDK and AI gateway that enables applications to access AI models from different providers through a common API.
It is a massively popular project with 61,800 GitHub stars, 92 million monthly downloads on PyPI, and is used by high-profile companies like NVIDIA, Netflix, AT&T, and Okta.
The project says that the release pipeline was compromised on October 21 and a threat actor pushed version 1.107.0 to the Docker registry and PyPI.
"This version contained compiled malware which steals credentials and loads remote-code execution tools," the maintainer says, adding that customers running the private enterprise were not impacted.
In a post-mortem of the incident, the maintainer says that the following LiteLLM artifacts were affected in the attack:
PyPI: litellm==1.107.0: all seven wheels, live from 11:39:51 to 13:23 UTC
Docker Hub: v1.107.0, latest, main-latest, and main-stable: pointed to compromised image index sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e from 11:46:56 to 14:20 UTC
GHCR: v1.107.0, latest, main-latest, and main-stable: pointed to the compromised image indexes below from 11:46:56 UTC until they were made unavailable by 13:51 UTC
ghcr.io/berriai/litellm: sha256:1bbcb1443bc9…
ghcr.io/berriai/litellm-database: sha256:c00f9d92c427…
ghcr.io/berriai/litellm-non_root: sha256:7b00e91cd2fe…
Multiple application security companies detected the attack within six minutes of publishing the malicious LiteLLM version and analyzed the payload.
According to the researchers, the attacker did not touch the LiteLLM application code and modified only the installation package to place three malicious files (cook.pth, cook.py, and sitecustomize.py) in the environment's Python’s library directory.
"During normal startup, Python processes executable .pth lines and then attempts to import sitecustomize," Socket researchers explain.
Endor Labs notes that this way the payloads are executed before the application every time Python is launched in the environment. Running Python or pip to investigate an affected installation also triggered the malware.
The malware targeted the following data:
Cloud and deployment credentials: AWS, Azure, Google Cloud, Kubernetes, Docker, and infrastructure-management secrets.
AI credentials and configuration: Authentication files for AI development tools, plus LiteLLM’s stored provider credentials and model settings.
Developer secrets and private keys: Git, GitHub, npm, PyPI, and CI/CD credentials; .env files; SSH, GPG, and TLS keys.
Browser data: Saved login, cookie, autofill/payment, and browsing-history databases.
Host and runtime data: Environment variables, shell and application histories, and system and network information.
The stolen data is encrypted using an AES-256-CBC key that is encrypted with an RSA-4096 key and then uploaded to ‘litellm[.]dev/healthcheck’
One of the malicious files, sitecustomize.py, launches a detached loader that checks a GitHub-hosted pointer every hour and downloads Python from an external server for execution on the host.
The malicious packages have been removed, but potentially impacted users should stop affected deployments and inspect environments without launching the Python interpreter.
Infected systems should be isolated and rebuilt from clean backups, and all exposed secrets should be rotated immediately.
Removing the LiteLLM package directory alone may leave startup files or an active loader behind.
Currently, the recommended recovery version is LiteLLM 1.106.2, which is the latest clean release before the attack.
Previously, the project also suffered a breach in March, when the TeamPCP hacking group published malicious LiteLLM versions on PyPI after breaching Aqua Security's Trivy vulnerability scanner used in LiteLLM's CI/CD pipeline.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report
Related Articles:
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
MacSync malware uses public iCloud calendars to deliver new payloads
Fake LastPass Authenticator GitHub repos push new Rapuncel infostealer
Coder's registry infrastructure compromised to push malicious modules
WordPress SEO plugin Rank Math compromised to backdoor websites