9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25SHA-256 hash
Reported by 3 independent sources · first reported by Socket · last reported
Last reported yesterday
What the reports say
3 reports, newest first · the exact sentence from each-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks“"9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25",”
-
New LiteLLM Supply Chain Attack Hits PyPI and Docker“cook.py (SHA-256)9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25”
-
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials“cook.py: 9dd0a3926f96a37eb86cf1ee2310d9be93139cc4ebef3ef9e2efe9531390be25.”
Indicators reported together
named in the same reports- www.litellm[.]devin 3 reports
- 34bef04fe88ac9d0…acf5968305fain 3 reports
- litellm-1.107.0[.]datain 2 reports
- hxxp://www.litellm[.]dev/healthcheckin 2 reports
- 7f191632e7320705…6f5042b92bdbin 2 reports
- 1bbcb1443bc962e4…d3ac126c339ein 2 reports
- 20535d8fa11f786a…e449ed5f09adin 1 report
- hxxps://github[.]com/Berri-AI/litellmin 1 report
- 7598727f209d7170…375729aeb86din 1 report
- 6ea3d8ef6cf73a72…84e66675d2dfin 1 report
- 20a59e5a285799e7…4e998c2cd24bin 1 report
- bd1aeee419ea36da…ba6ed84a3ea5in 1 report
- 56b74573eed6e4aa…98caf1f4bcdfin 1 report
- hxxps://raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txtin 1 report
- 783c43bc455d2e05…325cfeab1433in 1 report
- a898fd08ad220fed…26545ecc4218in 1 report
- litellm[.]devin 1 report
- dropraw.githubusercontent[.]comin 1 report
- repogithub[.]comin 1 report
- 168.100.8[.]57in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.