Hackers have broken into the update system of LiteLLM, a popular AI tool, and spread a virus through it that steals passwords and other sensitive data. The developers suggest that the attackers may have gained access to the system by leaking secret keys in the responses of the AI assistant Claude Code.
Hackers have broken into the update system of LiteLLM, a popular AI tool, and spread a virus through it that steals passwords and other sensitive data. The developers suggest that the attackers may have gained access to the system by leaking secret keys in the responses of the AI assistant Claude Code.
This is reported by BleepingComputer.
On October 21, the attackers used stolen developer GitHub access keys to gain access to the system through which LiteLLM developers publish updates. They changed its settings so that the new version of the application would be compiled from their own repository, whose name differed from the real one by only one hyphen.
This resulted in an infected version of LiteLLM 1.107.0, which was available for download for about two hours. The malware also found its way into pre-built Docker images used to run applications.
The hackers hid the virus in the files included during installation, which allowed it to run automatically whenever Python was run on the infected computer, even if LiteLLM itself was not being used at the time.
The virus looked for access keys to AWS, Google Cloud, Azure, and GitHub, credentials for connecting to AI services, developer private keys, as well as saved passwords, cookies, and browser information. The malware could also download and execute additional code from attackers’ servers.
During the investigation, LiteLLM developers discovered that under certain conditions, Claude Code could accidentally include secret GitHub access keys in its responses. If these responses are stored in the system logs, the keys themselves may remain there. However, the investigation is still ongoing.
The infected versions have already been removed from access. Users who managed to install them are advised to isolate the affected systems, restore them from clean copies, and replace all access keys that could have fallen into the hands of hackers. For now, the developers recommend reverting to the safe version of LiteLLM 1.106.2.
And according to the developers, customers using a separate corporate version were not affected by the attack.
Previously, dev.ua wrote that in March, hackers were already distributing an infected version of LiteLLM . At that time, the malware could also automatically run on developers' computers and steal passwords, access keys to cloud services, or other confidential data.
