According to cybersecurity firm Aikido, files bundled with the compromised package executed automatically when Python started, even if an application did not import LiteLLM. The malware was designed to collect sensitive information from infected systems, including cloud credentials and API keys stored in LiteLLM’s database, potentially giving attackers access to services beyond the affected AI gateway.
The compromised package also contained a remote access trojan that launched a background process to retrieve and execute code from attacker-controlled infrastructure every hour, according to Aikido. This could allow attackers to continue executing commands on infected systems after the initial credential theft.
In its incident report, LiteLLM said attackers used stolen GitHub credentials associated with three developer accounts to manipulate its software release pipeline. The stolen credentials enabled changes to the release workflow, which was redirected to an attacker-controlled lookalike repository.
