Today liteLLM was compromised (account accessed by malicious actor?) and a compromised released was published : pypi package and docker image.
Official blog post
The commits have quiet suspicious title with totally suspect content:
I went away and decompress the payload on can check the code on this codeberg repository.
From liteLLM github issue:
How it was undermined
- On Monday, we temporarily expanded release permissions to allow two internal engineers to publish daily bugfix backports for customers.
- The attacker had access to three sets of developer github CLI credentials (more on this below). One of which had the ability to run github workflows.
- The attacker tried to merge a change to allow the releaser to be pointed at a different source repository, but was unable to due to our protections. One of the tokens held by the attacker belonged to one of our two Github organization owners. The attacker used this to disable branch protections and force push the change.
- Finally, they ran the compromised workflow, pointed at a lookalike repository (Berri-AI/litellm instead of BerriAI/litellm), which signed and published the poisoned artifacts.