LiteLLM 1.107.0 Supply Chain Compromise: PyPI Credential Stealer and Backdoor — Detection and Remediation Guide

---
title: Installation of Compromised LiteLLM 1.107.0 Package
id: 9c2e4a71-5b3d-4f6a-8e1c-2d7a9b0c3e5f
status: experimental
description: Detects pip/pip3/uv/poetry installation activity referencing the compromised LiteLLM 1.107.0 package distributed via PyPI in a supply chain attack delivering a credential stealer and backdoor.
references:
  - https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: linux
detection:
  selection_tool:
    Image|endswith:
      - '/pip'
      - '/pip3'
      - '/uv'
      - '/poetry'
      - '/python'
      - '/python3'
  selection_cmd:
    CommandLine|contains:
      - 'litellm==1.107.0'
      - 'litellm-1.107.0'
      - 'litellm 1.107.0'
  condition: selection_tool and selection_cmd
falsepositives:
  - None expected; version 1.107.0 is confirmed malicious and quarantined
level: critical
---
title: Python Process Accessing Cloud or SSH Credential Stores
id: 4f8b1d63-7a2e-4c9b-b5d3-1e6f8a0c2d4b
status: experimental
description: Detects Python processes accessing AWS, GCP, Azure, or SSH credential files — consistent with the credential stealer payload delivered via the compromised LiteLLM 1.107.0 package. LiteLLM deployments hold API keys in-process, making secret-store access by python interpreters high signal.
references:
  - https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.t1552.004
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|contains:
      - '/.aws/credentials'
      - '/.aws/config'
      - '/.ssh/id_rsa'
      - '/.ssh/id_ed25519'
      - '/.config/gcloud/'
      - '/.azure/'
      - '/.kube/config'
      - '/var/run/secrets/kubernetes.io/serviceaccount/token'
  selection_env:
    TargetFilename|endswith:
      - '/.env'
  condition: 1 of selection_*
falsepositives:
  - Legitimate cloud SDK or infrastructure-as-code tooling; tune per-host baselines and investigate python-initiated access specifically
level: high
---
title: Python Interpreter Spawning Shell or Network Utility After Package Install
id: 2d6c9e14-8b4f-4a7d-9c2e-5f1a3b7d0e6c
status: experimental
description: Detects python/pip processes spawning shells or data-transfer utilities (curl, wget, base64, nc) — consistent with post-install staging and exfiltration behavior observed in PyPI supply chain compromises such as the LiteLLM 1.107.0 incident.
references:
  - https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html
author: Security Arsenal
date: 2026/10/21
tags:
  - attack.execution
  - attack.exfiltration
  - attack.t1059.006
  - attack.t1041
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/pip'
      - '/pip3'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/base64'
      - '/openssl'
  condition: selection_parent and selection_child
falsepositives:
  - Some legitimate build tooling spawns subprocesses; correlate with recent litellm install events and outbound connections
level: high

// Hunt 1: Any installation or execution referencing compromised LiteLLM 1.107.0
let WindowStart = ago(30d);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated >= WindowStart
| where ProcessCommandLine has_any ("litellm==1.107.0", "litellm-1.107.0", "litellm 1.107.0")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Source="DeviceProcessEvents"),
(Syslog
| where TimeGenerated >= WindowStart
| where SyslogMessage has_any ("litellm==1.107.0", "litellm-1.107.0")
| project TimeGenerated, HostName, ProcessName, SyslogMessage, Source="Syslog")
| sort by TimeGenerated desc;
// Hunt 2: Python processes accessing credential stores (Linux via auditd/Syslog, Windows via Defender)
union isfuzzy=true
(DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("python", "python3", "python.exe", "pip", "pip3")
| where FolderPath has_any (".aws\\credentials", ".aws/credentials", ".ssh\\id_", ".ssh/id_", ".azure", ".config/gcloud")
   or FileName =~ ".env"
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FolderPath, FileName),
(Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has_any (".aws/credentials", ".ssh/id_rsa", ".ssh/id_ed25519", ".config/gcloud", "serviceaccount/token")
| where SyslogMessage has_any ("python", "pip")
| project TimeGenerated, HostName, ProcessName, SyslogMessage);
// Hunt 3: Outbound connections from python interpreters following a litellm install — exfil pivot
DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where InitiatingProcessFileName in~ ("python", "python3", "python.exe")
| where RemotePort in (443, 80)
| where RemoteUrl !has_any ("pypi.org", "files.pythonhosted.org", "openai.com", "anthropic.com", "azure.com", "amazonaws.com")
| summarize Connections=count(), RemoteIPs=make_set(RemoteIP), URLs=make_set(RemoteUrl) by DeviceName, InitiatingProcessCommandLine, bin(TimeGenerated, 1h)
| order by Connections desc;

-- LiteLLM 1.107.0 Compromise Triage: installed version + running processes
SELECT * FROM foreach(
  row={
    SELECT FullPath
    FROM glob(globs=['/usr/lib/python3*/site-packages/litellm-*/METADATA',
                     '/usr/local/lib/python3*/site-packages/litellm-*/METADATA',
                     '/opt/**/site-packages/litellm-*/METADATA',
                     '/home/*/.local/lib/python3*/site-packages/litellm-*/METADATA',
                     '/home/*/*/site-packages/litellm-*/METADATA',
                     '/usr/lib/python3*/dist-packages/litellm-*/METADATA'])
  },
  query={
    SELECT FullPath,
           read_file(filename=FullPath, length=4096) AS Metadata,
           parse_regex(source=FullPath, regex='litellm-(?P<Version>[0-9.]+)').Version AS InstalledVersion
    FROM scope()
    WHERE InstalledVersion =~ '1\\.107\\.0'
  })

-- Running python processes with litellm loaded or in command line, plus their network connections
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'litellm'
   OR Exe =~ 'python'

SELECT Pid, Name, CommandLine,
       netstat().RemoteIP AS RemoteIP,
       netstat().RemotePort AS RemotePort,
       netstat().Status AS ConnStatus
FROM pslist()
WHERE CommandLine =~ 'litellm'

#!/bin/bash
# LiteLLM 1.107.0 Supply Chain Compromise - Verify & Remediate
set -euo pipefail

echo "=== [1/5] Checking installed LiteLLM versions (all interpreters) ==="
for PY in python3 python; do
  if command -v "$PY" >/dev/null 2>&1; then
    VER=$("$PY" -m pip show litellm 2>/dev/null | awk '/^Version:/{print $2}')
    if [ -n "${VER:-}" ]; then
      echo "  $PY -> litellm $VER"
      if [ "$VER" == "1.107.0" ]; then
        echo "  *** COMPROMISED VERSION DETECTED - removing ***"
        "$PY" -m pip uninstall -y litellm
      fi
    fi
  fi
done

echo "=== [2/5] Scanning virtualenvs and site-packages for litellm 1.107.0 ==="
find / -type d -name "litellm-1.107.0*" 2>/dev/null | while read -r d; do
  echo "  FOUND: $d  -- remove after review"
done

echo "=== [3/5] Checking Docker images for compromised package ==="
if command -v docker >/dev/null 2>&1; then
  docker images --format '{{.Repository}}:{{.Tag}} {{.ID}}' | while read -r img id; do
    if docker run --rm --entrypoint sh "$id" -c 'pip show litellm 2>/dev/null | grep -q "1.107.0"' 2>/dev/null; then
      echo "  *** COMPROMISED IMAGE: $img ($id) ***"
    fi
  done
fi

echo "=== [4/5] Auditing python persistence points for backdoor tampering ==="
for PYDIR in /usr/lib/python3*/site-packages /usr/local/lib/python3*/site-packages; do
  for f in sitecustomize.py usercustomize.py; do
    [ -f "$PYDIR/$f" ] && echo "  REVIEW: $PYDIR/$f (mtime: $(stat -c %y "$PYDIR/$f"))"
  done
done
grep -rn "litellm" ~/.bashrc ~/.bash_profile ~/.profile /etc/profile.d/ 2>/dev/null || echo "  No shell-profile references found"

echo "=== [5/5] MANUAL ACTIONS REQUIRED ==="
cat <<'EOF'
  1. ROTATE all credentials present on any host that ran litellm 1.107.0:
     - LLM provider API keys (OpenAI, Anthropic, Azure OpenAI, Bedrock, etc.)
     - AWS/GCP/Azure credentials, SSH keys, kubeconfig service accounts
     - CI/CD secrets accessible to build agents during the exposure window
  2. Review egress logs from affected hosts for unexpected HTTPS destinations.
  3. Rebuild affected container images from a clean base; do not patch in place.
  4. Preserve evidence (pip logs, shell history, image layers) before cleanup
     if forensic investigation is in scope.
EOF