A compromised LiteLLM component has raised concerns about how trusted AI software can become an entry point into networks. LiteLLM’s build pipeline installed the tool without locking it to a verified version, allowing poisoned code to be included in the build, resulting in the creation of malicious LiteLLM packages on PyPI. A malicious Python startup file could run when the software started instead of being imported by an application, allowing it to collect credentials from developer workstations and build runners, including cloud keys, repository tokens, and AI service keys.

Trivy Component Compromise Leads to Potential Supply Chain Attacks The malicious LiteLLM supply chain attacks were triggered after the compromised Trivy component entered the project’s build environment.

Teams should scrutinize cloud, source-control, package registry, and Kubernetes audit records for unusual token usage, new service accounts, suspicious outbound connections, and unexpected repositories. Indicators of compromise (IoCs): - Malicious package versions: LiteLLM 1.82.7 and LiteLLM 1.82.8 - Malware: SANDCLOCK Credential-stealing payload associated with compromised CI/CD runners - File type: .pth Malicious Python startup file used for automatic execution - File path: /proc//mem Process memory path reportedly scraped for CI/CD secrets - GitHub repositories: tpcp-docs and docs-tpcp Unexpected repositories highlighted for threat-hunting activity Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world