Popular AI tool LiteLLM says unrevoked key allowed hackers to target users - The Record from Recorded Future News
LiteLLM, a popular AI development tool, confirmed that an accidentally exposed master key enabled hackers to distribute credential-harvesting malware to tens of thousands of users last week.
In a root-cause analysis published Friday, the project traced the attack to its own mistaken exposure in May of a configuration file containing the master key to an internal tool used by LiteLLM to run AI agents. Although the company spotted the publication and removed the file, it failed to revoke the exposed key.
Earlier this month, an unidentified attacker used the key to access LiteLLM's tooling and grab an access token giving them control over all of LiteLLM's repositories on GitHub. The attacker then exploited "multiple independent security controls" last week to distribute a version of the tool containing credential-harvesting malware to users.
Malware Distribution
Google-owned cloud security company Wiz reported the compromised package was downloaded about 49,000 times, with stolen cloud credentials being tested within hours. The malicious package remained on the Python Package Index (PyPI) for approximately two hours.
Within about four and a half hours of it being initially uploaded, the attacker was trying out stolen login credentials for Amazon's AWS cloud service to see which of Amazon's AI models the accounts could access.
Attack Pattern
Wiz noted this matched a pattern known as "LLMjacking," where criminals use stolen cloud accounts to run AI services and leave victims with the bill. Microsoft revealed the malware was designed to run whenever Python started on an infected machine, regardless of whether the program used LiteLLM.
LiteLLM warned anyone who installed the compromised version (1.107.0) on an internet-connected computer should assume their credentials were stolen. The company advised changing every password and access key the affected computer could reach and revoked tokens across its internal systems and vendor platforms.
Previous Incident
The incident marks the second supply chain compromise of LiteLLM this year. In March, attackers published malicious versions to PyPI in a campaign linked to the TeamPCP hacking group. Australian police have since charged two men allegedly associated with TeamPCP.
Related
