LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
Summary: The LiteLLM Python package was compromised in a supply chain attack affecting version 1.107.0, distributed through PyPI wheels and Docker images, delivering a credential stealer called privcollect and a backdoor daemon that checks a GitHub dead drop every hour. LiteLLM's Oliver Jensen said the malicious actions came through three engineers' GitHub accounts, apparently via stolen GitHub CLI OAuth tokens, with one account triggering the project-releaser run and another approving it; the package has been quarantined on PyPI and the malicious Docker images removed.
Bottom line: The malware runs via a cook.pth file before LiteLLM is even imported, harvesting cloud tokens, private keys, AI tooling credentials, and browser data and posting them to litellm[.]dev/healthcheck - and LiteLLM says it has not yet identified how the tokens were stolen, so it cannot assert no further access to those GitHub accounts.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026