LiteLLM 1.107.0 遭入侵，含惡意程式版本經官方渠道發佈
Popular LiteLLM library hacked, version with hidden malware released
LiteLLM 1.107.0 在 GitHub OAuth token 遭竊後遭供應鏈攻擊，含惡意程式的版本經官方渠道發佈。惡意程式會收集雲端服務金鑰、私鑰、瀏覽器資料及與 AI 工具相關的連線檔案，並在背景從遠端位置擷取及執行新程式碼。受影響用戶應使用乾淨、安全的裝置撤銷並更換所有敏感登入資料及金鑰，並回退至先前安全版本。
LiteLLM version 1.107.0 was compromised in a supply chain attack using stolen GitHub OAuth tokens.
Attackers triggered and approved malicious releases containing credential-stealing malware and a background backdoor.
Review the affected installation wheels and mitigation steps.
The issue concerns version 1.107.0, which was distributed through official distribution channels and ready-made application packages. The project managers immediately withdrew the problematic material and removed the corresponding publications.
How the GitHub breach happened
According to the company's investigation, the attackers used stolen digital keys to access three engineering accounts on the code development platform GitHub. They used one account to initiate the release process of the new version and a second to approve it.
All keys that were used were immediately canceled by LiteLLM, while as a precaution, almost all users were removed from the official project team on the platform. The company's security director, Oliver Jensen, said that the investigation into the incident is still ongoing.
READ ALSO
How artificial intelligence is making email scams more dangerous
What did the malicious version contain?
Analysis of the problematic version showed that it included two main dangerous pieces of code:
- A program that collects sensitive data, such as digital cloud service keys, private keys, browser data, and connection files related to artificial intelligence tools.
- A hidden program in the background that regularly checks a remote location on the internet to retrieve and execute new code.
The malware is automatically activated when the program is launched. The data collected by the attackers is compressed into a file and automatically sent to an external address via an internet request.
What should those affected do?
Those who downloaded this problematic version are urged to immediately cancel and replace all sensitive logins and keys using a clean, secure device. It is also recommended that they roll back to a previous secure version of the software.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
來源：DEV Community · dev.to