Date: 10/22/2026
Severity: Medium
Summary
Researcher identified a software supply chain attack compromising LiteLLM version 1.107.0 on PyPI and Docker, distributing malicious Python startup hooks that execute automatically when Python initializes. The embedded credential stealer targets cloud credentials, AI provider API keys, developer secrets, SSH/private keys, browser data, and environment variables, then exfiltrates collected information to an attacker-controlled endpoint. A secondary remote code loader retrieves configuration from GitHub and can execute remotely supplied Python code, while the release provenance references a lookalike repository, raising concerns about the software build and release process.
Indicators of Compromise (IOC) List
Domains/URLs | http://www.litellm.dev/healthcheck https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt https://github.com/Berri-AI/litellm |
Hash | 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d
0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a
668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6
462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7
c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054
1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00
12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484
7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb
84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d
9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25
03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea
34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa
b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465
1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e
bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5
56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf
|
Recorded source revision | 20535d8fa11f786a6c24df7488a0e449ed5f09ad
|
Directory-adding commit | 783c43bc455d2e05d3cfaf194c2f325cfeab1433
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://github.com/Berri-AI/litellm" or url like "https://github.com/Berri-AI/litellm" or siteurl like "https://github.com/Berri-AI/litellm" or domainname like "http://www.litellm.dev/healthcheck" or url like "http://www.litellm.dev/healthcheck" or siteurl like "http://www.litellm.dev/healthcheck" or domainname like "https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt" or url like "https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt" or siteurl like "https://raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt" |
Detection Query 2 : | sha256hash IN ("1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e","668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6","c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054","7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb","12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484","9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25","1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00","462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7","34bef04fe88ac9d0aae0475630b1738681d15b94f233ac8aa46eacf5968305fa","b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465","56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf","03ac2a871b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea","7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d","84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d","bd1aeee419ea36da9aa2b657288da4101887be468f020ac63d22ba6ed84a3ea5","0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a")
|
Reference:
LiteLLM PyPI and Docker Compromise Steals Cloud and AI Credentials