Compromised LiteLLM Release Executes Code Before Any Import Via Wheel Artifacts
Attackers hijacked a LiteLLM build pipeline to inject zero-import backdoors into official wheel packages, proving clean Git tags offer zero safety against build-system tampering.
On October 21, the developers of LiteLLM reported a supply-chain compromise affecting version 1.107.0. All seven wheel packages published to PyPI during a brief window contained a secret-stealing payload and a remote code loader. The malicious build executed automatically simply by starting Python in an environment where the package was installed, even if the application never imported LiteLLM. Official Git tags remained clean because the malicious artifacts were built and signed by the legitimate CI process.
The poisoned release was available on PyPI from 11:39 to 13:23 UTC, and affected containers were also pushed to Docker Hub and GHCR. According to an initial team investigation, an attacker obtained GitHub CLI tokens from internal service logs exposed to the internet. An organization owner token allowed them to disable branch protections and redirect the build to a fork instead of the canonical repository.
The attack mechanism relied on abuse of Python packaging internals. A configuration change added a hook directory to the service section of the wheel via the maturin build tool, which the installer placed directly into site-packages. First, a cook.pth file executed arbitrary Python code during normal interpreter initialization, bypassing the safety assumption that un-imported libraries are dormant. Second, an automatically loaded sitecustomize.py module spawned a background process that periodically fetched instructions to harvest SSH keys, cloud tokens, CI/CD secrets, and local LLM provider keys.
Similar zero-import execution vectors have appeared in other recent supply-chain campaigns tracked by CodeScoring, such as poisoned releases of openai-mcp and claudedashbord. Security analysts emphasize that checking a library name, a clean Git tag, or a valid digital signature is no longer enough when the build pipeline itself is untrusted. Developers whose environments were exposed must isolate systems, kill background processes, revoke harvested credentials, and downgrade to version 1.106.2.
Source: habr
Comments
Help shape the next version: Add context or suggest a correction. AI review can add points toward a rewrite. Reviews and updates may take time; a full meter does not guarantee a new version.