litellm-1.107.0[.]dataDomain
Reported by 2 independent sources · first reported by Socket · last reported
Last reported yesterday
What the reports say
2 reports, newest first · the exact sentence from each-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks“The compromised wheel packaged cook.pth, cook.py, and sitecustomize.py under litellm-1.107.0[.]data/purelib/.”
-
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials“litellm-1.107.0[.]data/purelib/cook.pth”
Indicators reported together
named in the same reports- hxxp://www.litellm[.]dev/healthcheckin 2 reports
- www.litellm[.]devin 2 reports
- 9dd0a3926f96a37e…e9531390be25in 2 reports
- 34bef04fe88ac9d0…acf5968305fain 2 reports
- 20535d8fa11f786a…e449ed5f09adin 1 report
- hxxps://github[.]com/Berri-AI/litellmin 1 report
- 7598727f209d7170…375729aeb86din 1 report
- 7f191632e7320705…6f5042b92bdbin 1 report
- 6ea3d8ef6cf73a72…84e66675d2dfin 1 report
- 20a59e5a285799e7…4e998c2cd24bin 1 report
- 1bbcb1443bc962e4…d3ac126c339ein 1 report
- bd1aeee419ea36da…ba6ed84a3ea5in 1 report
- 56b74573eed6e4aa…98caf1f4bcdfin 1 report
- hxxps://raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txtin 1 report
- 783c43bc455d2e05…325cfeab1433in 1 report
- a898fd08ad220fed…26545ecc4218in 1 report
- litellm[.]devin 1 report
- workloads[.]microsoftin 1 report
- compromise[.]microsoftin 1 report
- remediation[.]microsoftin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.