[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$ftuEDOBe-oeun1rmYAdz9qZ9ZGZyP2YD41wSel9fJB4c":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"74cce44d-80ea-4329-86a0-dee5d42de31a","litellm-pypi-compromise-delivers-credential-stealing-startup-hooks","40242e1d-6e2d-4dd1-9f2e-84ba28d5ebe1","LiteLLM PyPI Compromise Delivers Credential-Stealing Startup Hooks","Attackers published a trojanized version of the widely-used LiteLLM package to PyPI, embedding malicious Python startup hooks that execute automatically at interpreter launch — meaning every Python process on an affected machine runs the payload, not just code that explicitly imports LiteLLM. The malware harvests credentials from cloud environments, browsers, SSH keys, and developer tools across Windows and macOS, dramatically broadening the blast radius beyond the intended application. This incident underscores how implicit trust in public package registries can transform a single compromised dependency into a full credential compromise across an entire developer environment. Because Python startup hooks persist independently of the package itself, simply uninstalling LiteLLM does not remediate the threat, making thorough forensic investigation and credential rotation mandatory.","**Immediate actions:**\n- Audit all Python environments for the presence of LiteLLM 1.107.0 and inspect `sitecustomize.py`, `usercustomize.py`, and `PYTHONSTARTUP` hooks for unauthorized modifications.\n- Rotate all credentials (cloud API keys, SSH keys, browser-stored secrets, database passwords) on any system where the compromised package was installed.\n- Terminate and investigate suspicious processes spawned from Python interpreters on affected hosts.\n\n**Long-term improvements:**\n- Enforce the use of a private package mirror or artifact repository (e.g., Artifactory, AWS CodeArtifact) with allowlisting of approved package versions before they reach developer machines.\n- Implement cryptographic hash pinning (e.g., `requirements.txt` with `--hash` flags) and integrate automated integrity verification into CI\u002FCD pipelines for all third-party dependencies.\n- Adopt a software composition analysis (SCA) tool that continuously monitors published packages for version anomalies, unexpected maintainer changes, or known malicious indicators.\n\n**Detection measures:**\n- Deploy endpoint detection rules to alert on unexpected modifications to Python startup files (`sitecustomize.py`, `PYTHONSTARTUP` environment variable) and unauthorized network egress from Python interpreter processes.\n- Monitor cloud credential usage logs for anomalous API calls or access from unfamiliar IP addresses following any package installation events.",[12,13,14,15,16,17,18],"CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 7: Continuous Vulnerability Management",{"NIST SP 800-53 SI-2: Flaw Remediation":20,"CIS Control 17: Incident Response Management":21,"OWASP A06:2021 Vulnerable and Outdated Components":22,"CIS Control 7: Continuous Vulnerability Management":23,"CIS Control 2: Inventory and Control of Software Assets":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"SI-2 requires organizations to identify, report, and remediate software flaws — including malicious code introduced through third-party packages — in a timely and structured manner, directly addressing the need for rapid response to this trojanized release.","Microsoft's guidance that simple package removal is insufficient highlights the need for a formal IR process covering forensic scoping, credential rotation, and persistence mechanism removal — all core IR management requirements.","This category explicitly covers risks from unverified or compromised third-party components; enforcing dependency integrity checks and using a vetted package registry would have intercepted the malicious LiteLLM build.","Continuous vulnerability management — including scanning for known-bad package versions and anomalous dependency changes — would have detected the malicious LiteLLM release before it was deployed across developer environments.","Maintaining an approved software inventory with verified versions would have flagged the unexpected publication of LiteLLM 1.107.0 and prevented its installation on developer machines.","This control requires organizations to identify and remediate technical vulnerabilities in software they use, which extends to monitoring public package registries for compromised releases and acting swiftly when one is identified.","Because the malware harvested credentials from multiple sources, strong secrets management practices — such as short-lived tokens and hardware-backed credentials — would have limited the value of the stolen material.","published","2026-10-23T20:21:09.990592+00:00","2026-10-23T20:21:09.956+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F10\u002F23\u002Finside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-python-startup-hooks\u002F","inside-the-litellm-1-107-0-supply-chain-compromise-credential-theft-through-pyth-e59453","Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"a77e431a-b80e-4cec-8bf5-527517c5404a","2026-10-24","morning","ThreatNoir Weekend Brief — October 24","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-24\u002Fthreatnoir-morning-brief-2026-10-24.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]