LiteLLM supply chain attack steals passwords, cloud keys and AI API keys

[Outlaw92]

A popular AI developer tool has been hit by a supply chain attack. The Register's Jessica Lyons reports that attackers compromised LiteLLM's release process and pushed a malicious version, 1.107.0, to the Python Package Index and Docker

The bad release carried an information stealer and a remote access trojan. Wiz researchers say the attackers used a lookalike GitHub organisation called Berri-AI to inject three malicious files into the build

The stealer has 16 modules that grab browser credentials, cloud credentials for AWS, Google Cloud and Azure, AI model API keys, and SSH and GPG keys. It encrypts the stolen data and sends it to a server disguised with a convincing LiteLLM domain

PyPI quarantined the malicious version within hours, and the Docker images were removed. The last safe version is 1.106.2. LiteLLM is downloaded around 23 million times a week, and a compromise in March reportedly exposed more than 2,500 organisations, so this is the second serious incident this year

AI developer tools are becoming a favourite target, because they hold valuable API keys and cloud credentials. With the Rank Math and PHP problems as well, it has been a heavy week for supply chain security. Anyone who installed version 1.107.0 should rotate every secret immediately

How do you protect yourself against malicious package updates? And should package registries do more to stop attacks like this?

LiteLLM supply chain attack hoovers up passwords and secretswww.theregister.com