LiteLLM Supply Chain Attack Steals Cloud and AI Credentials via Lookalike Repository
Attackers compromised LiteLLM version 1.107.0 by injecting malicious code through a lookalike GitHub repository (Berri-AI vs. BerriAI), exploiting insufficient verification in the project's release workflow. The malware used Python startup hooks to execute silently — without any explicit LiteLLM import — making it exceptionally stealthy and difficult for developers to detect manually. This attack demonstrates how a single weak link in a CI/CD pipeline can expose cloud credentials, API keys, and developer secrets at scale across all downstream users. The incident underscores why automated integrity verification and provenance checks for open-source packages are no longer optional for teams handling sensitive infrastructure.
Tactical Insight
Immediate actions
- Rotate all cloud credentials, API keys, and developer secrets for any environment that consumed LiteLLM 1.107.0.
- Pin package versions and verify SHA-256 hashes or GPG signatures before installing any PyPI package or container image.
- Audit CI/CD pipeline configurations to confirm that release workflows only pull from verified, official upstream repositories.
Long-term improvements
- Implement a Software Bill of Materials (SBOM) process so every dependency and its provenance is tracked and auditable before deployment.
- Enforce repository namespace validation checks (e.g., exact owner/repo matching) in all automated release and dependency-fetch workflows.
- Adopt a private package mirror or artifact registry with allowlisting to prevent lookalike or typosquatted packages from reaching build systems.
Detection measures
- Integrate automated supply chain scanning tools (e.g., Socket, Sigstore, or Snyk) into your CI/CD pipeline to flag suspicious packages at publish or install time.
- Monitor runtime process behavior for unexpected network calls or credential-access patterns that may indicate malicious startup hooks.
- Enable alerts for any new or changed Python startup hooks (`.pth` files, `sitecustomize.py`) in build and production environments.