Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.
Summary
A malicious version of LiteLLM 1.107.0 has been distributed on PyPI, which includes a credential stealer and a backdoor that activates with every Python startup. The article details how this compromised package was introduced, what sensitive information it targets, and how to identify if your system has been affected.
Comments (123 of ) ⌛