LiteLLM engineer GitHub credentials stolen; official release process becomes a distribution channel for malicious programs

Hackers used stolen engineer GitHub credentials to tamper with the official release process of the open-source AI model chaining tool LiteLLM, causing version 1.107.0 to be implanted with an infostealer and a remote code execution backdoor, distributed via PyPI and a Docker image repository. The investigation found that the attackers obtained the credentials of 3 engineers, used an account with administrative privileges to disable code protection measures, and changed the location from which the release system reads source code to a similarly named impersonation repository; the 1.107.0 source code publicly available on GitHub does not contain the malicious files. SafeDep's analysis found that the contaminated package adds malicious files to the Python environment, and that other programs in the same environment may also trigger the theft when they start, collecting cloud service credentials, AI service keys, remote login private keys, and keys in the LiteLLM database and exfiltrating them.