LiteLLM, a widely-deployed open-source platform for artificial intelligence developers, disclosed Friday that a supply-chain attack striking tens of thousands of users last week stemmed from a credential accidentally exposed in May that was never revoked.
The project's root-cause analysis, made public Friday, identified the breach's origin as an inadvertent exposure months earlier of a configuration file holding the master key to an internal tool LiteLLM operates for running AI agents. The company detected the publication at that time and took down the file, yet neglected to invalidate the compromised key. An unknown threat actor leveraged the unrevoked key this month to breach LiteLLM's infrastructure and obtain an access token granting them authority over LiteLLM's complete GitHub repository portfolio.
The attacker then weaponized "multiple independent security controls" the following week to push out a compromised iteration of the tool embedded with credential-stealing malware to end users, per the initial incident report.
Wiz, the cloud security division owned by Google, reported that the tainted package received roughly 49,000 downloads and that cloud credentials extracted from LiteLLM users were being validated within hours. The malicious package remained accessible on the Python Package Index (PyPI) for approximately two hours. Within approximately four and a half hours from initial deployment, the attacker had begun testing the pilfered login credentials against Amazon's AWS cloud infrastructure to determine which of Amazon's AI offerings the compromised accounts could utilize.
Wiz characterized this activity as consistent with "LLMjacking," a criminal technique where attackers commandeer stolen cloud accounts to operate AI services while imposing the operational expenses on the legitimate account holders. To date, no organization has publicly acknowledged experiencing a breach connected to this incident.
Microsoft indicated the malware was engineered to activate whenever Python launched on a compromised system, regardless of whether any running application actually depended on LiteLLM.
LiteLLM cautioned that anyone deploying the compromised version (1.107.0) on a networked device should treat their credentials as compromised. Affected parties received guidance to reset all passwords and API keys accessible from the infected machine.
LiteLLM announced it was invalidating tokens across its own infrastructure and third-party vendor integrations.
This marks the second supply-chain compromise targeting LiteLLM in the current year. During March, malicious builds were uploaded to PyPI in an operation subsequently attributed to the TeamPCP hacking collective. Australian law enforcement has since brought charges against two individuals suspected of TeamPCP membership.
