Breaking News: LiteLLM Python malicious variations 1.82.7 and 1.82.8 have been uploaded to PyPi, containing a credential stealing logic. If you have been affected, rotate your keys now
Overview
LiteLLM was just lately compromised after a maintainer’s account was hacked. This was allegedly executed by a risk actor referred to as TeamPCP, who claimed accountability. The risk actors used this account to add two malicious LiteLLM variations on PyPi containing an infostealer, which targets AWS, GCP, GitHub, SSH keys, crypto foreign money wallets comparable to Bitcoin, Litecoin, Ethereum, Solana and rather more.
What Is LiteLLM
LiteLLM is an open-source Python library that gives a unified interface to name 100+ LLMs (OpenAI, Anthropic, VertexAI, and many others.) utilizing the usual OpenAI enter/output format.
Who is affected
Anyone who put in LiteLLM in variations 1.82.7 and 1.82.8 was affected.
How to inform if you’re affected:
- If your code incorporates an unpinned set up configuration for litellm to a earlier model, and also you put in it within the final 24h you might need been compromised
- Unpinned – litellm
- Pinned – litellm==1.82.6
- Pinned however nonetheless susceptible to new updates – litellm^=1.82.6
Impact
- LiteLLM has over 3M downloads per day, which signifies that a lot of customers might need been compromised through the time interval the malware was on-line.
- OX Customers weren’t affected by the malicious LiteLLM bundle
Recommended Actions
Immediate Actions:
- Rotate your session tokens and API keys
- Pin your dependencies to particular variations to keep away from putting in unknown variations mechanically
Technical Analysis
The affected variations comprise a malicious pth file, which is a Python configuration file, inside it there’s a base64 encoded payload with one other base64 payload inside which is executed, and in addition a 3rd base64 payload – meant to steal data and persist on affected machines.
The first base64 encoded payload
After decoding it we already see the decoding and execution logic
The second base64 payload inside the primary payload
The malware searches and extracts passwords, SSH keys and personal keys, AWS credentials, Kubernetes secrets and techniques and Google Cloud credentials contained in the sufferer machine.
List of focused SSH keys recordsdata:
- ~/.ssh/id_rsa
- ~/.ssh/id_ed25519
- ~/.ssh/id_ecdsa
- ~/.ssh/id_dsa
- ~/.ssh/authorized_keys
- ~/.ssh/known_hosts
- ~/.ssh/config
Searching for k8s, GCP, Azure credentials
- /and many others/kubernetes/admin.conf
- /and many others/kubernetes/kubelet.conf
- /and many others/kubernetes/controller-manager.conf
- /and many others/kubernetes/scheduler.conf
- /var/run/secrets and techniques/kubernetes.io/serviceaccount/token
- /var/run/secrets and techniques/kubernetes.io/serviceaccount/ca.crt
- /var/run/secrets and techniques/kubernetes.io/serviceaccount/namespace
- /run/secrets and techniques/kubernetes.io/serviceaccount/token
- /run/secrets and techniques/kubernetes.io/serviceaccount/ca.crt
- ~/.config/gcloud
- /root/.config/gcloud/application_default_credentials.json
- /.azure
The malware additionally reads the consumer’s historical past, npmrc, mongorc configurations, LDAP, redis, mysql, postgres and postfix
The malware additionally searches for Slack and Discord credentials and common API keys
Searching for crypto foreign money configurations in numerous crypto currencies, comparable to
- Bitcoin
- Litecoin
- Dogecoin
- Ethereum
- Solana
- Cardano
- Zcash
- Dashcore
- Ripple
- Monero
After gathering all the data, the malware encrypts the information with its hard-coded key utilizing openssl and sends it to the distant C2 server – fashions[.]litellm[.]cloud
There’s additionally a 3rd payload, which reads a URL – checkmarx[.]zone and tries to obtain an executable and runs it within the background, the logic additionally incorporates a hardcoded youtube URL, probably to guard itself from evaluation – when coming into the checkmarx[.]zone we solely see a YouTube video hyperlink at present, that means that the payload wasn’t but activated.
The YouTube hyperlink from the C2 server at present results in the track “Bad Apple!!”
List of IOCs
- fashions[.]litellm[.]cloud
- checkmarx[.]zone
Affected Packages – PyPi
| Package identify | Affected variations |
| litellm | 1.82.7, 1.82.8 |
Conclusions
This is one other instance of a big scale incident after just one maintainer account was compromised, just like what we’ve seen within the NPM and Shai Hulud incidents final yr
How to guard your group:
- Always pin your dependencies to secure and examined variations
- Rotate your keys periodically and take away unused credentials
