LiteLLM 1.107.0在PyPI上发布的版本遭到篡改，被植入凭证窃取器和远程代码执行后门1。受影响版本包含7个wheel文件，覆盖Linux、macOS和Windows平台1。恶意代码通过maturin构建工具注入，包括cook.pth、cook.py和sitecustomize.py等文件1。
该恶意代码在任何Python进程启动时自动运行，能够收集SSH密钥、云凭证、CI/CD密钥、AI工具token、浏览器密码和LLM提供商密钥等敏感信息1。窃取的数据通过HTTP POST请求发送至www.litellm.dev/healthcheck[1](#source-1)。后门机制每小时从GitHub读取domain.txt文件，随后下载并执行来自攻击者服务器的代码[1](#source-1)。
事件发生于2026年10月21日（UTC），攻击者使用的GitHub账户letters9813已于13:40 UTC被清除1。PyPI已删除该恶意版本1。LiteLLM 1.106.2、1.107.0rc1和1.107.0rc2等版本未包含恶意代码1。
LiteLLM version 1.107.0 released on PyPI on October 21, 2026 (UTC) contained malicious code designed to steal credentials and establish remote code execution capabilities 1. The compromised version was distributed across seven wheel files compatible with Linux, macOS, and Windows platforms 1.
The malicious payload included multiple components engineered to exfiltrate sensitive information 1. Three key files—cook.pth, cook.py, and sitecustomize.py—were injected through the maturin build tool and executed upon any Python process startup 1. The credential stealer targeted SSH keys, cloud credentials, CI/CD keys, AI tool tokens, browser passwords, and LLM provider API keys 1. Collected data was transmitted via HTTP POST requests to www.litellm.dev/healthcheck 1. A persistent backdoor mechanism read instructions hourly from a GitHub-hosted domain.txt file and downloaded executable code from the attacker's server for runtime execution 1.
PyPI removed the affected version from its repository 1. The attacker's GitHub account, letters9813, returned a 404 error as of 13:40 UTC 1. Secure versions including 1.106.2, 1.107.0rc1, and 1.107.0rc2 contained no malicious code 1.
评论
还没有评论，欢迎留下第一条。