LiteLLM Compromised, Steals Credentials

T1Covered by 1 source · first reported by Wiz Research at 21 Oct, 13:44 UTC

In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability.

security

Sources

• T1LiteLLM Compromised, Steals CredentialsWiz Research21 Oct, 13:44