Compromised LiteLLM Package on PyPI Discovered Distributing Credential Stealer

A severe supply chain security incident hit the Python ecosystem as a compromised version of the popular LiteLLM package, version 1.107.0, was published to PyPI. Security analysts discovered that the malicious release secretly installs a credential stealer and a persistent remote code execution backdoor directly onto developer systems src="https://safedep.io/images/github.png" alt="GitHub Security Advisory Context". Unlike typical supply chain attacks that merely target production servers, this exploit immediately targets local environments by automatically executing whenever any Python process starts, even if the application never imports LiteLLM.

The attack mechanism relies on malicious files placed inside python's site-packages directory during installation. Specifically, a rogue helper script acts as a credential stealer, harvesting sensitive assets including SSH keys, cloud provider access tokens, CI/CD secrets, browser saved passwords, and LLM provider credentials stored inside local databases. This stolen data is then encrypted and exfiltrated to an external domain. Meanwhile, a secondary companion component acts as an automated backdoor daemon, regularly checking external servers for malicious updates and maintaining unauthorized persistent access to the compromised machine.

Investigations into the release pipeline reveal that the malicious payload bypassed upstream GitHub source controls and was injected directly during the build and packaging phase. An unauthorized entry was added to the build tool configuration within the distribution tarball, causing packaging tools to bundle a hidden directory into the final wheel. PyPI administrators have since removed the malicious release, and clean versions such as 1.106.2 and release candidates remain unaffected. However, the incident highlights a glaring vulnerability in automated software publishing pipelines where build configurations can be quietly altered without triggering standard source-code review processes.

This incident serves as a stark reminder of the growing threat landscape targeting software development kits and artificial intelligence toolchains. As engineering teams increasingly adopt specialized utility packages to manage multi-model LLM routing, attackers view these dependencies as high-value targets. Compromising a developer tool provides instant access to downstream enterprise environments, cloud infrastructure, and proprietary API keys. Security teams must move beyond simple manifest checks and implement runtime behavioral monitoring to catch malicious package execution at install time before operational integrity is compromised.