LiteLLM Release Pipeline Compromised to Deliver Credential-Stealing Malware
Attackers gained access to LiteLLM's CI/CD release pipeline and injected an info-stealer into a published PyPI package and container images, targeting cloud credentials, AI provider tokens, and developer secrets. This is a textbook software supply chain attack: by compromising the build and distribution infrastructure rather than the source code itself, the threat actors bypassed most traditional code review controls. The fact that the malicious release reached PyPI and Docker Hub before detection illustrates how trusted distribution channels can be weaponised against downstream users at scale. Because LiteLLM is used by organisations like NVIDIA, Netflix, and Okta, the blast radius of even a short-lived compromise is enormous. It underscores that securing the pipeline — including secrets, signing keys, and publishing credentials — is as critical as securing the application code.
Tactical Insight
Immediate actions
- Isolate any systems that consumed LiteLLM v1.107.0 and rotate all secrets, API keys, cloud credentials, and browser-stored tokens on those hosts.
- Verify the integrity of installed packages using cryptographic hashes or Sigstore/cosign attestations before re-deploying any updated version.
- Audit CI/CD pipeline access logs to identify how the pipeline was initially compromised and which accounts or tokens were abused.
Long-term pipeline hardening
- Enforce least-privilege access for all CI/CD service accounts and restrict PyPI/Docker Hub publishing tokens to dedicated, short-lived OIDC-based credentials rather than long-lived secrets.
- Implement mandatory artifact signing (e.g., Sigstore for PyPI, cosign for container images) and enforce signature verification in all downstream consuming workflows.
- Require multi-party approval (two-person integrity) for any release pipeline step that pushes artefacts to public registries.
Detection and response measures
- Integrate software composition analysis (SCA) and malware scanning into the release pipeline so that published artefacts are scanned before they become publicly available.
- Deploy runtime monitoring on developer and CI/CD systems to detect credential-access behaviours (e.g., reading `.aws/credentials`, browser credential stores) consistent with info-stealer activity.