Mate in the Loopby Kenny Jung
KOEN

AI 보안 · LLM · AI 에이전트기타 산업 (software / AI tooling (LLM gateway library))

Python 라이브러리 LiteLLM의 1.107.0 버전이 PyPI와 Docker 이미지(v1.107.0, latest, main-latest, main-stable)로 악성 배포됐다고 Datadog이 분석했다.

AI 분석 초안 · Kenny 검토 승인Codex 검증 · 부분 일치읽는 시간 3분

출처 [1] securitylabs.datadoghq.com · 2026년 10월 21일 · “LiteLLM supply chain compromise: What you need to know” ↗
도입 단계: 운영 — A named organisation runs it in day-to-day operations.

요약

Python 라이브러리 LiteLLM의 1.107.0 버전이 PyPI와 Docker 이미지(v1.107.0, latest, main-latest, main-stable)로 악성 배포됐다고 Datadog이 분석했다. 공격자는 엔지니어 3명의 GitHub CLI OAuth 토큰을 탈취해 LiteLLM의 비공개 릴리스 워크플로우를 실행했고, 페이로드는 Python이 시작될 때마다 도는 자격증명 탈취기와 2단계 원격 접속 백도어(RAT)였다. PyPI 게시(11:39 UTC)부터 격리(13:20 UTC)·Docker 이미지 제거(13:53 UTC)까지 약 두 시간 노출됐고, 주간 다운로드는 약 2,300만 건이다.

근거: 원문 [1], 아래 사실 F1–F6

Kenny의 관점

라이브러리가 그 프로젝트 자신의 비공개 릴리스 워크플로우를 통해 오염됐다. 뚫린 곳은 코드가 아니라 엔지니어 3명의 토큰이었다. latest 태그의 Docker 이미지를 그대로 받아 쓰는 배포 환경이라면 그 약 두 시간이 곧 노출 시간이다. 이 판단은 Datadog 외 다른 출처가 영향 범위를 더 작게 확인하면 약해진다.

AI 초안 · Kenny 검토 승인

분석 (영문)

What happened (vendor-reported, according to Datadog): a supply-chain compromise of an LLM tooling library on 2026-10-21. Who: LiteLLM as the publisher and its downstream users as victims; attacker not named. Vector: stolen GitHub CLI OAuth tokens from three engineers used to run the private release workflow. Impact: a credential stealer and RAT shipped in a release of a library with about 23 million weekly downloads, live for about two hours.

Control: not stated in the source. Datadog lists only after-the-fact remediation (remove files, revert to 1.106.2, rotate credentials from a clean machine, audit logs); it does not say which preventive control would have stopped the release.

For the pattern ai-supply-chain-security, this is evidence about the attack surface, not about a defence adopted by an operator. The stage is set to production because the attack ran through the library's real release channel, not a lab setup; the source names no downstream operator that was hit.

원문에서 확인한 사실 (영문)

  1. F1According to Datadog Security Labs, the PyPI package litellm version 1.107.0 and Docker images tagged v1.107.0, latest, main-latest and main-stable on GHCR and Docker Hub were compromised. [1]
  2. F2According to Datadog, the malicious release was published to PyPI at 11:39 UTC, PyPI quarantined it at 13:20 UTC, and the affected Docker images were removed at 13:53 UTC — "approximately two hours before being removed". [1]
  3. F3According to Datadog, "attackers used stolen GitHub CLI OAuth tokens from three engineers' accounts to launch LiteLLM's private release workflow"; the attacker is not named. [1]
  4. F4According to Datadog, the library had "about 23 million weekly downloads". [1]
  5. F5According to Datadog, the payload was "a credential stealer that runs whenever Python starts" plus "a second-stage remote access trojan (RAT) backdoor". [1]
  6. F6Datadog's remediation steps: remove cook.pth, cook.py and sitecustomize.py from site-packages, revert to version 1.106.2, rotate all affected credentials "from a clean machine", and audit logs for use of exposed credentials. [1]

언급된 조직: LiteLLM, PyPI

반론 — Codex 검증 메모

Codex가 각 문장을 원문과 대조하고 반대 증거를 찾은 기록입니다 (영문 원문). 판정: Codex 검증 · 부분 일치.

  • 반대 증거LiteLLM’s October 23 canonical investigation says PyPI was quarantined by 13:23 UTC, GHCR tags were unavailable by 13:51 UTC, and Docker Hub tags were removed or repointed at 14:20 UTC. It also says the attacker changed the private release workflow to build from a malicious fork. [2]
  • 반대 증거LiteLLM confirms the incident and lists separate affected windows for PyPI, Docker Hub, and GHCR; it says its private enterprise release was unaffected. [3]
문장별 검증 메모 5건
  • analysispartly-supported: LiteLLM’s downstream users were victims. — The source establishes publication of compromised artifacts, but does not identify downstream users who installed or ran them.
  • takepartly-supported: 뚫린 곳은 코드가 아니라 엔지니어 3명의 토큰이었다. — Token theft is supported, but the source does not establish that code was untouched. LiteLLM’s later investigation says the attacker changed the release workflow.
  • takepartly-supported: latest 태그의 Docker 이미지를 그대로 받아 쓰는 배포 환경이라면 그 약 두 시간이 곧 노출 시간이다. — Exposure depends on pulling or running the compromised image during the affected interval. LiteLLM reports different intervals by registry, with Docker Hub’s lasting until 14:20 UTC.
  • takepartly-supported: What was breached was three engineers’ tokens, not the code. — Token theft is supported, but the source does not establish that code was untouched. LiteLLM’s later investigation says the attacker changed the release workflow.
  • takepartly-supported: Any deployment that pulls the `latest` Docker image was exposed for those roughly two hours. — This omits the condition that the compromised image had to be pulled or run during the affected interval. LiteLLM reports different intervals by registry, with Docker Hub’s lasting until 14:20 UTC.

출처

  1. [1] securitylabs.datadoghq.com — “LiteLLM supply chain compromise: What you need to know” 원문
  2. [2] docs.litellm.ai 반대 증거 (Codex)
  3. [3] docs.litellm.ai 반대 증거 (Codex)

이어 읽기

같은 산업

같은 AI 기술

쉬핑뉴스넷

HD현대와 안두릴이 미 해군이 쓰던 368톤급 무인 시험선으로 롱비치 앞바다에서 자율운항 공동 시연을 했다.

항해·임무 변경·편대 운항에 더해 기관 고장 시 비상조치까지 시연했다. 기관 상태를 실시간으로 보고 이상 탐지 후 자동 대응하는 '기관 자율' 기능이 핵심 구성 요소다.

해운·항만AI·머신러닝AI 에이전트단계 · 시범(PoC)
Codex 검증 · 부분 일치관점 읽기