{ "version": 1, "event_id": "evt_301b68a4d1f669d2", "url": "https://xiyu.news/events/evt_301b68a4d1f669d2/", "json": "https://xiyu.news/api/events/evt_301b68a4d1f669d2.json", "type": "security_incident", "status": "developing", "category": "technology", "title": { "zh": "LiteLLM 1.107.0 供应链攻击：恶意版本窃取凭证并植入后门", "en": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor" }, "current_state": { "zh": "SlowMist 报告称，LiteLLM 再次遭遇供应链攻击：PyPI 上的恶意版本 1.107.0 及其 Docker 镜像会在 Python 启动时自动执行，窃取云凭证、AI API 密钥和 SSH 私钥，并实现远程代码执行；建议用户避免使用 1.107.0，从干净镜像重建，轮换凭证并锁定 1.106.2。", "en": "SlowMist reported that LiteLLM suffered another supply chain attack: malicious version 1.107.0 on PyPI and its Docker images auto-executes on Python startup to steal cloud credentials, AI API keys and SSH private keys and enables remote code execution, with users advised to avoid 1.107.0, rebuild from clean images, rotate credentials and pin 1.106.2." }, "first_seen_at": "2026-10-21T17:31:51.266456+00:00", "last_updated_at": "2026-10-22T06:31:30.923318+00:00", "last_material_change_at": "2026-10-22T06:31:30.923318+00:00", "confidence": 0.75, "updates_count": 3, "sources_count": 3, "entities": [ "backdoor", "compromised", "credential", "installs", "litellm", "pypi", "stealer" ], "identifiers": [], "topics": [ "ai-devtools", "credential-theft", "litellm", "pypi", "supply-chain-attack" ], "updates": [ { "update_id": "upd_fc03adbab276a131", "event_id": "evt_301b68a4d1f669d2", "occurred_at": "2026-10-21T14:00:26Z", "published_at": "2026-10-21T14:00:26Z", "first_seen_at": "2026-10-21T17:31:51.266456Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "PyPI 上被篡改的 LiteLLM 1.107.0 安装凭据窃取器和后门", "title_en": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor", "what_changed_zh": "PyPI 上被篡改的 LiteLLM 1.107.0 版本携带了凭据窃取器和后门，促使维护者告知用户锁定到 1.106.2 或更早版本，同时向企业客户分发禁运中的修复程序。", "what_changed_en": "A tampered LiteLLM 1.107.0 release on PyPI shipped a credential stealer and backdoor, prompting maintainers to tell users to pin to 1.106.2 or earlier while an embargoed fix is distributed to enterprise customers.", "current_state_zh": "PyPI 上被篡改的 LiteLLM 1.107.0 版本携带了凭据窃取器和后门，促使维护者告知用户锁定到 1.106.2 或更早版本，同时向企业客户分发禁运中的修复程序。", "current_state_en": "A tampered LiteLLM 1.107.0 release on PyPI shipped a credential stealer and backdoor, prompting maintainers to tell users to pin to 1.106.2 or earlier while an embargoed fix is distributed to enterprise customers.", "detailed_summary_zh": "A tampered LiteLLM 1.107.0 release on PyPI shipped a credential stealer and backdoor, prompting maintainers to tell users to pin to 1.106.2 or earlier while an embargoed fix is distributed to enterprise customers.", "detailed_summary_en": "A tampered LiteLLM 1.107.0 release on PyPI shipped a credential stealer and backdoor, prompting maintainers to tell users to pin to 1.106.2 or earlier while an embargoed fix is distributed to enterprise customers.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [ { "url": "https://news.ycombinator.com/item?id=50181114", "title": "Community discussion" } ], "confidence": 0.75, "story_ids": [ "hackernews:story:50181114" ], "sources": [ { "url": "https://safedep.io/litellm-pypi-compromise-credential-stealer-backdoor/", "label": "abhisek", "source_type": "hackernews", "official": false } ] }, { "update_id": "upd_357e553ffd64f351", "event_id": "evt_301b68a4d1f669d2", "occurred_at": "2026-10-21T15:28:02Z", "published_at": "2026-10-21T15:28:02Z", "first_seen_at": "2026-10-21T17:31:49.746836Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "LiteLLM今年第二次遭投毒：不调用也能偷密钥", "title_en": "LiteLLM今年第二次遭投毒：不调用也能偷密钥", "what_changed_zh": "JFrog 披露该供应链攻击还影响官方 Docker 镜像，PyPI 全部七个平台安装包均被植入木马；PyPI 已移除恶意版本，Docker Hub 已撤下受影响镜像；攻击者使用的发布源码指向名称仅差一个连字符的仿冒仓库；建议将凭证视为可能泄露、隔离并重建环境、轮换密钥，回退到 1.106.2。", "what_changed_en": "JFrog reported that the supply-chain attack also affected official Docker images and all seven PyPI platform packages; PyPI removed the malicious version and Docker Hub pulled affected images; the release source pointed to a typosquatted repository differing by one hyphen; users are advised to treat credentials as exposed, isolate and rebuild environments, rotate secrets, and roll back to 1.106.2.", "current_state_zh": "LiteLLM 1.107.0 的恶意 PyPI 包和受影响 Docker 镜像已被下架；JFrog 建议受影响用户轮换凭证并重建环境，已确认安全回退版本为 1.106.2，但恶意代码如何混入发布流程仍未查清。", "current_state_en": "Malicious LiteLLM 1.107.0 PyPI packages and affected Docker images have been removed; JFrog advises affected users to rotate credentials and rebuild environments, with 1.106.2 confirmed as the safe rollback, while how the malicious code entered the release process remains unclear.", "detailed_summary_zh": "Security firm JFrog discovered that LiteLLM version 1.107.0 and its official Docker images were compromised in a supply chain attack that installs credential-stealing malware and a persistent backdoor, affecting all PyPI platform packages and prompting advice to rotate credentials and rebuild environments.", "detailed_summary_en": "Security firm JFrog discovered that LiteLLM version 1.107.0 and its official Docker images were compromised in a supply chain attack that installs credential-stealing malware and a persistent backdoor, affecting all PyPI platform packages and prompting advice to rotate credentials and rebuild environments.", "background_zh": "LiteLLM 是一款开源 AI 网关（LLM 代理），用一套兼容 OpenAI 的 API 统一接入 AI 技术栈，把请求路由到 OpenAI、Anthropic 等模型，并集中管理 API 密钥，支持包括完全离线在内的自托管部署。这是该项目今年第二次遭遇供应链攻击，今年 3 月就曾因另一场供应链攻击遭到投毒。", "background_en": "LiteLLM is an open-source AI gateway (LLM proxy) that puts an AI stack behind one OpenAI-compatible API, routing requests to models such as OpenAI and Anthropic and centrally managing API keys, with self-hosting including air-gapped deployments. This is the second supply chain attack on the project this year, after an earlier incident in March.", "community_discussion_zh": "Hacker News 的讨论更多聚焦于问题的系统性而非单一软件包：有人建议使用 canarytokens 来检测凭证是否被盗；有人抱怨权限弹窗疲劳和日常化的软件包安装让开发者对风险变得麻木；还有人质疑一个三年内拥有 5.5 万次提交的项目为何会以这种方式被攻破。一位评论者援引“三名开发者的 GitHub 凭证被窃取”的说法，认为这是系统性问题，并表示会把 LiteLLM 固定在更早的版本直到有进一步消息。", "community_discussion_en": "Hacker News commenters focused on the systemic nature of the problem rather than the single package: one suggested using canarytokens to detect credential theft, another complained that permission pop-up fatigue and routine package installation have desensitized developers to risk, and a third questioned how a project with 55,000 commits in three years could be hit this way. One commenter, citing reports that three unique developer GitHub credentials were compromised, called the pattern systemic and said they would pin LiteLLM to a version before this one until further notice.", "market_impact_zh": "传导渠道是凭证暴露：自托管的 LiteLLM 实例通常在其数据库和主机环境中保存模型 API 密钥、云平台凭证和 SSH 私钥，因此运行此类网关的加密与 AI 智能体团队可能面临部署基础设施凭证外泄的风险，无论是否调用过该库，都需要轮换密钥并重建环境。", "market_impact_en": "The transmission channel is credential exposure: self-hosted LiteLLM instances commonly hold model API keys, cloud credentials and SSH keys in their databases and host environments, so crypto and AI-agent teams running such gateways may have had deployment infrastructure credentials exposed, requiring key rotation and environment rebuilds regardless of whether they invoked the library.", "importance_score": 8.0, "references": [ { "url": "https://www.litellm.ai/", "title": "LiteLLM — Open-Source AI Gateway & LLM Proxy" }, { "url": "https://github.com/BerriAI/litellm", "title": "GitHub - BerriAI/litellm: The fastest, litest AI Gateway. Rust core with..." }, { "url": "https://bolster.ai/blog/pypi-supply-chain-attacks", "title": "PYPI Security: How to Prevent Supply Chain Attacks in Python Projects" } ], "confidence": 0.96, "story_ids": [ "telegram:theblockbeats:201703" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/373048?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_217ed0b4c02f62a5", "event_id": "evt_301b68a4d1f669d2", "occurred_at": "2026-10-22T03:44:23Z", "published_at": "2026-10-22T03:44:23Z", "first_seen_at": "2026-10-22T06:31:30.923318Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "【慢雾：LiteLLM 再遭供应链攻击，恶意版本 1.107.0 窃取云凭证与 AI 密钥】", "title_en": "【慢雾：LiteLLM 再遭供应链攻击，恶意版本 1.107.0 窃取云凭证与 AI 密钥】", "what_changed_zh": "SlowMist 报告称，LiteLLM 再次遭遇供应链攻击：PyPI 上的恶意版本 1.107.0 及其 Docker 镜像会在 Python 启动时自动执行，窃取云凭证、AI API 密钥和 SSH 私钥，并实现远程代码执行；建议用户避免使用 1.107.0，从干净镜像重建，轮换凭证并锁定 1.106.2。", "what_changed_en": "SlowMist reported that LiteLLM suffered another supply chain attack: malicious version 1.107.0 on PyPI and its Docker images auto-executes on Python startup to steal cloud credentials, AI API keys and SSH private keys and enables remote code execution, with users advised to avoid 1.107.0, rebuild from clean images, rotate credentials and pin 1.106.2.", "current_state_zh": "SlowMist 报告称，LiteLLM 再次遭遇供应链攻击：PyPI 上的恶意版本 1.107.0 及其 Docker 镜像会在 Python 启动时自动执行，窃取云凭证、AI API 密钥和 SSH 私钥，并实现远程代码执行；建议用户避免使用 1.107.0，从干净镜像重建，轮换凭证并锁定 1.106.2。", "current_state_en": "SlowMist reported that LiteLLM suffered another supply chain attack: malicious version 1.107.0 on PyPI and its Docker images auto-executes on Python startup to steal cloud credentials, AI API keys and SSH private keys and enables remote code execution, with users advised to avoid 1.107.0, rebuild from clean images, rotate credentials and pin 1.106.2.", "detailed_summary_zh": "SlowMist reported that LiteLLM suffered another supply chain attack: malicious version 1.107.0 on PyPI and its Docker images auto-executes on Python startup to steal cloud credentials, AI API keys and SSH private keys and enables remote code execution, with users advised to avoid 1.107.0, rebuild from clean images, rotate credentials and pin 1.106.2.", "detailed_summary_en": "SlowMist reported that LiteLLM suffered another supply chain attack: malicious version 1.107.0 on PyPI and its Docker images auto-executes on Python startup to steal cloud credentials, AI API keys and SSH private keys and enables remote code execution, with users advised to avoid 1.107.0, rebuild from clean images, rotate credentials and pin 1.106.2.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:121023" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/115731", "label": "foresightnews", "source_type": "telegram", "official": false } ] } ] }