SCSE-H-001ACTIVE
The Oct-21 LiteLLM event is a confirmed compromise of the trusted release path that produced malicious artifacts through official PyPI/container channels.
Affected-system denominator remains separate.
جارٍ تحميل البيانات التشغيلية
TOPIC
LiteLLM 1.107.0 release-pipeline compromise: official malicious PyPI/container artifacts, credential-stealing startup hooks, release-workflow identity, signing/provenance limits, downstream exposure boundaries and defensive implications.
1
6
4
11
3
NEW — trusted release path compromise and malicious official artifacts verified; seven PyPI wheels + official container tags affected during bounded window; startup-hook credential theft verified; affected-system count, downstream propagation count, credential misuse and actor identity remain unresolved.
SOFTWARE_SUPPLY_CHAIN_RESEARCH_TOPIC
—
—
—
The Oct-21 LiteLLM event is a confirmed compromise of the trusted release path that produced malicious artifacts through official PyPI/container channels.
Affected-system denominator remains separate.
Signature/provenance checks alone can fail when trusted release workflow/source selection is compromised.
Exact consumer policy/enforcement state.
Affected executed environments should be treated as potentially compromised because Python startup can trigger credential collection without importing LiteLLM.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
Related Domains
الإجمالي: 6 Evidence
Official release pipeline published malicious litellm 1.107.0; all seven PyPI wheels and official Docker/GHCR mutable tags were affected during bounded windows; official GitHub source tag was clean; private enterprise registry stated unaffected.
لا يثبت: Does not prove affected-system/victim count, downstream package count or later credential misuse.
فتح Run المصدرCanonical RCA: leaked internal admin key → internal Agent Platform access → GitHub CLI OAuth tokens → privileged release-workflow modification/approval/deletion → official workflow pointed to Berri-AI/litellm → poisoned official artifacts.
لا يثبت: Does not identify actor or quantify downstream victims.
Independent analysis verifies Python startup-hook credential collector and Unix-oriented loader; payload can execute when Python starts even without importing LiteLLM.
لا يثبت: Does not provide global victim denominator or prove remote second stage on every host.
All seven 1.107.0 wheels and official container affected; source/tag diverged from wheel payload; credential stealer active; conditional remote loader dead-drop was empty when observed; no evidence links October compromise to TeamPCP/March incident.
لا يثبت: Does not prove remote second-stage execution or shared actor with prior incident.
Government CERT classifies the event as software supply-chain compromise and identifies conditional propagation risk through internal mirrors, registries, build pipelines and deployments if affected artifacts were reused.
لا يثبت: Does not prove actual downstream redistribution or count.
Independent research reports ~23M weekly LiteLLM downloads as ecosystem-popularity context, confirms official-channel 1.107.0 compromise/startup credential theft, and states no established connection to earlier 2026 compromise.
لا يثبت: 23M weekly downloads is NOT affected installs/systems/victims.
Install/execution/IR denominator.
Affected artifacts could propagate through mirrors/builds, but no public evidence establishes a count of downstream packages/images/systems actually compromised.
SBOM/registry/cache/build logs and downstream incident evidence.
The Oct-29 Cursor event is a confirmed trusted-marketplace distribution of malicious Claude Code-branded extension artifacts.
Publishing root cause remains separate.
CVE-2026-97229 is a real operational RCE risk against affected self-managed GitLab, with authoritative known-exploitation status and independently reproduced code execution.
Confirmed-success victim IR and broader exploitation telemetry.
Custom GitLab deployments that substitute their own Ruby can remain vulnerable after a GitLab version upgrade unless Ruby/Onigmo is patched.
Prevalence/telemetry of custom runtime builds.
Successful GitLab RCE can expose CI/CD secrets/repos and downstream delivery trust, but Alpine did not confirm theft/tampering.
Independent downstream-compromise case evidence.
Model repositories that can execute custom Python are software-supply-chain boundaries; model weights and repository identity alone are insufficient trust anchors.
Broader ecosystem measurements of custom-code loading paths
Security controls emphasizing weights, known malware or format hazards can miss malicious Python referenced by model configuration, as demonstrated in Load/Mine.
Controlled scanner-by-scanner coverage baseline
AI developer platforms, CI/CD, release pipelines and extension/package ecosystems are adjacent credential-acquisition surfaces; distinct incidents remain distinct identities absent shared evidence.
Shared upstream credential/publisher/build lineage or authoritative attribution.
No reliable public count of hosts/environments that installed and executed LiteLLM 1.107.0 or affected container tags during the compromise window.
Version-specific registry telemetry plus execution/IR/provider/customer reporting.
No verified public denominator/count for internal mirrors, derived images, build outputs or downstream packages incorporating affected artifacts.
Registry/cache/SBOM/build provenance, downstream hashes and incident reports.
Credential-stealing capability and release-workflow credential abuse are established, but downstream stolen-secret reuse and October actor identity are not quantified/attributed.
Cloud/source-control audit logs, victim IR, actor-linked infrastructure and authoritative attribution.
No reliable denominator exists for custom GitLab deployments upgraded at the app layer but still using vulnerable Ruby/Onigmo.
Version-aware GitLab+Ruby telemetry or large-sample authenticated inventory.
CREDENTIAL_MISUSE_ATTRIBUTION