Overview
- Security teams discovered that a trojanized LiteLLM v1.107.0 was uploaded on Wednesday, October 21 and served malicious wheels and container images before registries quarantined and removed the artifacts.
- The release planted cook.pth, cook.py and sitecustomize.py into site-packages so the payload runs whenever Python starts and can collect SSH keys, cloud tokens, browser data, CI secrets and LiteLLM proxy keys.
- sitecustomize.py forks a detached hourly daemon that reads a GitHub-hosted pointer for a command-and-control domain and can download and execute second-stage Python code, giving the attacker persistent remote code execution.
- Investigators say the attacker used a lookalike repository and abused stolen GitHub CLI OAuth tokens tied to three engineers to run the project’s private release pipeline; LiteLLM has revoked the tokens, tightened release controls and is still investigating.
- Researchers observed stolen AWS credentials being validated within hours of exfiltration, and they urge teams to remove or unpin v1.107.0, hunt for the three malicious files and markers, isolate and rebuild affected hosts, and rotate any exposed secrets with a safe pin of v1.106.2.