LiteLLM Poisoned for the Second Time This Year: Keys Can Be Stolen Without Invocation

Beating AI News Flash: Security firm JFrog has discovered that the popular open-source AI model gateway LiteLLM has once again suffered a supply chain attack. Its latest version 1.107.0 was implanted with malicious programs, and the official Docker images were also affected. LiteLLM can uniformly invoke models such as OpenAI and Anthropic and centrally manage API keys. In March of this year, it was already poisoned by another supply chain attack.

This attack was more covert. Hackers hid three additional files in the Python installation package. After users install it, as long as the relevant Python environment is started, the malicious code will run automatically even if LiteLLM is not invoked. It will collect browser passwords, SSH private keys, credentials for cloud platforms such as AWS, and authentication information for development tools such as Claude, Codex, and Cursor. It will also attempt to read the model API keys stored in the LiteLLM database and send them to a server disguised as an official domain.

The attackers also left a persistent backdoor that checks for remote instructions once per hour and, when necessary, downloads and executes new code. More troublesome is that the official version source code on GitHub does not contain these malicious files, but all seven platform installation packages released to PyPI were implanted with trojans. Through Docker build records, the community found that the source code address used by the release system pointed to a counterfeit repository whose name differed from the official repository by only one hyphen. How it infiltrated the release process remains unclear.

Currently, PyPI has removed the malicious version, and Docker Hub has also taken down the affected images. JFrog reminds users who have installed or run 1.107.0 to treat the relevant credentials as potentially compromised, isolate and rebuild the environment, and rotate sensitive credentials such as API keys, rather than simply uninstalling the software. The confirmed safe rollback version is 1.106.2.