[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTXAL4QNlF5URTSXszWboJPh6rWZzbK1N6IUfLu-S7pM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"3f9d5302-b88f-4c80-88a5-4d32d7eb3510","litellm-supply-chain-attack-steals-cloud-and-ai-credentials-via-lookalike-repository","252cee3b-0651-4f92-9434-e301947094a3","LiteLLM Supply Chain Attack Steals Cloud and AI Credentials via Lookalike Repository","Attackers compromised LiteLLM version 1.107.0 by injecting malicious code through a lookalike GitHub repository (Berri-AI vs. BerriAI), exploiting insufficient verification in the project's release workflow. The malware used Python startup hooks to execute silently — without any explicit LiteLLM import — making it exceptionally stealthy and difficult for developers to detect manually. This attack demonstrates how a single weak link in a CI\u002FCD pipeline can expose cloud credentials, API keys, and developer secrets at scale across all downstream users. The incident underscores why automated integrity verification and provenance checks for open-source packages are no longer optional for teams handling sensitive infrastructure.","**Immediate actions:**\n- Rotate all cloud credentials, API keys, and developer secrets for any environment that consumed LiteLLM 1.107.0.\n- Pin package versions and verify SHA-256 hashes or GPG signatures before installing any PyPI package or container image.\n- Audit CI\u002FCD pipeline configurations to confirm that release workflows only pull from verified, official upstream repositories.\n\n**Long-term improvements:**\n- Implement a Software Bill of Materials (SBOM) process so every dependency and its provenance is tracked and auditable before deployment.\n- Enforce repository namespace validation checks (e.g., exact owner\u002Frepo matching) in all automated release and dependency-fetch workflows.\n- Adopt a private package mirror or artifact registry with allowlisting to prevent lookalike or typosquatted packages from reaching build systems.\n\n**Detection measures:**\n- Integrate automated supply chain scanning tools (e.g., Socket, Sigstore, or Snyk) into your CI\u002FCD pipeline to flag suspicious packages at publish or install time.\n- Monitor runtime process behavior for unexpected network calls or credential-access patterns that may indicate malicious startup hooks.\n- Enable alerts for any new or changed Python startup hooks (`.pth` files, `sitecustomize.py`) in build and production environments.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 17: Incident Response Management":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates supply chain security measures including assessing the security practices of suppliers and service providers, which directly applies to vetting open-source package repositories and their release pipelines.","SI-2 requires organizations to verify the integrity of software from external sources, which would have mandated hash or signature checks that would have caught the tampered wheel distributions.","Socket's scanner detected the compromise within seven minutes; having a defined incident response plan tied to such tooling ensures rapid credential rotation and containment when supply chain alerts fire.","This category specifically covers risks from unverified third-party components; enforcing component integrity verification in the SDLC would have prevented the malicious package from being consumed.","Continuously scanning dependencies and container images for known-malicious or tampered packages would have flagged the compromised LiteLLM wheel before deployment.","This control requires organizations to assess and address vulnerabilities in software they use, including third-party packages, which encompasses validating the integrity of open-source dependencies.","The attack's goal was credential theft; applying least-privilege access and credential scoping for cloud and API keys limits the blast radius when secrets are exfiltrated via a supply chain compromise.","published","2026-10-21T17:20:48.987546+00:00","2026-10-21T17:20:48.954+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fsocket.dev\u002Fblog\u002Flitellm-compromise?utm_medium=feed","litellm-pypi-package-and-docker-images-compromised-to-steal-cloud-and-ai-credent-6b67cc","LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]