Attackers compromise LiteLLM 1.107.0 with credential-stealing malware

The affected release spread through PyPI wheels and Docker images, delivering a credential stealer and a backdoor. BerriAI has paused releases while investigating how stolen GitHub tokens were exposed, according to RuntimeWire. The package has since been quarantined on PyPI, according to The Hacker News.

• All seven distributed wheel files contained malware, according to Cyber Security News.

Covered by 3 publishers within 3 hours of the first report.

• The Hacker News: LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor

Reporting3

CSN Cyber Security News LiteLLM Compromised – Hackers Injected an Infostealer and RAT in the Latest 1.107.0 PyPI Release · Guru Baran 11:11 AM

RTW RuntimeWire BerriAI: stolen GitHub tokens apparently used to publish compromised LiteLLM 1.107.0 · Emerson Redding 1:11 PM

THN The Hacker News LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor · info@thehackernews.com (The Hacker News) 2:01 PM