LiteLLM version 1.107.0 was compromised in a supply chain attack using stolen GitHub OAuth tokens.
Attackers triggered and approved malicious releases containing credential-stealing malware and a background backdoor.
Review the affected installation wheels and mitigation steps.
The issue concerns version 1.107.0, which was distributed through official distribution channels and ready-made application packages. The project managers immediately withdrew the problematic material and removed the corresponding publications.
How the GitHub breach happened
According to the company's investigation, the attackers used stolen digital keys to access three engineering accounts on the code development platform GitHub. They used one account to initiate the release process of the new version and a second to approve it.
All keys that were used were immediately canceled by LiteLLM, while as a precaution, almost all users were removed from the official project team on the platform. The company's security director, Oliver Jensen, said that the investigation into the incident is still ongoing.
READ ALSO
How artificial intelligence is making email scams more dangerous
What did the malicious version contain?
Analysis of the problematic version showed that it included two main dangerous pieces of code:
- A program that collects sensitive data, such as digital cloud service keys, private keys, browser data, and connection files related to artificial intelligence tools.
- A hidden program in the background that regularly checks a remote location on the internet to retrieve and execute new code.
The malware is automatically activated when the program is launched. The data collected by the attackers is compressed into a file and automatically sent to an external address via an internet request.
What should those affected do?
Those who downloaded this problematic version are urged to immediately cancel and replace all sensitive logins and keys using a clean, secure device. It is also recommended that they roll back to a previous secure version of the software.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)