Fixed publication in the PyPI repository of a malicious release of the library LiteLLM, counting 23 million downloads per week, as well as the insertion of malicious code into the official Docker image of the project. This is not the first such incident with LiteLLM – in March of this year, attackers already published malicious releases after intercepting the credentials of the maintainer. This time, the attackers posted a version of LiteLLM 1.107.0, in which malicious code was embedded to organize remote command execution, as well as search and send credentials, keys and access tokens.
The malicious code was inserted at the stage of the assembly process without compromising the git repository. Once installed, the malicious code is activated before LiteLLM is imported by installing the cook.pth, cook.py, and sitecustomize.py files into the Python libraries directory. These files are run every time Python is executed on the system, without the user having to do anything.
Python first runs the file cook.pth, which has only one line “import cook” to import the cook.py script that collects credentials. Next, the sitecustomize.py script is imported, which is used to download external code in the background (the download parameters are determined by the link “raw.githubusercontent.com/letters9813/pythonclient-test/main/domain.txt”). The malicious code in both scripts is compressed using zlib and encoded using the Base64 method. An indicator of compromise can be the appearance of the files “/tmp/.pc_once_*” and “/tmp/remote_code_loader.lock” in the system.
After activation, the cook.py file scans connection parameters to cloud services, repositories and systems continuous integration (AWS, Azure, Google Cloud, Kubernetes, Docker, GitHub CLI, Vault, Terraform, Packer), developer accounts, Git connection parameters, npm and PyPI settings, files with environment variables, private keys for SSH, PGP and TLS, AI tool settings, browser databases with Cookies, stored data and history, information about processes and environment variables. The detected data is encrypted using AES-256-CBC + RSA-4096 algorithms and is sent in the form of a verification request to the litellm.dev website created by the attackers.