Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

A compromised version of LiteLLM 1.107.0, a Python library for natural language processing, was uploaded to the Python Package Index (PyPI) and installs a credential stealer and backdoor on affected systems. The malicious package was uploaded on April 24, 2023, and was available for installation until it was removed on April 26, 2023. The backdoor allows an attacker to execute arbitrary commands on the compromised system, while the credential stealer extracts sensitive information such as API keys and access tokens. The security vulnerability was discovered by the SafeDep team, who have set up a monitoring system to track malicious packages on PyPI. The team has also created a list of known malicious packages, which can be found on their website.