www.litellm[.]devDomain
Reported by 5 independent sources · first reported by Datadog Security Labs · last reported
Last reported yesterday
What the reports say
5 reports, newest first · the exact sentence from each-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks“It then attempts an HTTP POST to hxxp://www.litellm[.]dev/healthcheck, using application/octet-stream, a fixed browser-like User-Agent, and a body checksum in an X-SHA256 header.”
-
New LiteLLM Supply Chain Attack Hits PyPI and Docker“Search egress logs for www.litellm[.]dev/healthcheck and container inventories for the image digest below.”
-
LiteLLM supply chain attack hoovers up passwords and secrets“…the encryption key with an RSA-4096 public key, and sends the encrypted data via HTTP POST to an attacker-controlled domain: hxxp://www.litellm[.]dev/healthcheck.”
-
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials“The archive is POSTed to hxxp://www.litellm[.]dev/healthcheck.”
-
LiteLLM supply chain compromise: What you need to know“Credential stealer (cook.py): Collects secrets and sends them, encrypted with AES-256 and RSA-4096, to the lookalike domain www.litellm[.]dev/healthcheck.”
Indicators reported together
named in the same reports- hxxp://www.litellm[.]dev/healthcheckin 3 reports
- 9dd0a3926f96a37e…e9531390be25in 3 reports
- 34bef04fe88ac9d0…acf5968305fain 3 reports
- 1bbcb1443bc962e4…d3ac126c339ein 3 reports
- litellm-1.107.0[.]datain 2 reports
- 7598727f209d7170…375729aeb86din 2 reports
- 7f191632e7320705…6f5042b92bdbin 2 reports
- litellm[.]devin 2 reports
- 20535d8fa11f786a…e449ed5f09adin 1 report
- hxxps://github[.]com/Berri-AI/litellmin 1 report
- 6ea3d8ef6cf73a72…84e66675d2dfin 1 report
- 20a59e5a285799e7…4e998c2cd24bin 1 report
- bd1aeee419ea36da…ba6ed84a3ea5in 1 report
- 56b74573eed6e4aa…98caf1f4bcdfin 1 report
- hxxps://raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txtin 1 report
- 783c43bc455d2e05…325cfeab1433in 1 report
- a898fd08ad220fed…26545ecc4218in 1 report
- 0aaf7ba346d41ef2…78a9969d9a1ain 1 report
- 462d0c9f67ca522d…3a1ec4a6fcf7in 1 report
- 668169d35b87bf51…89abd5e02ae6in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.