hxxp://www.litellm[.]dev/healthcheckURL
Reported by 3 independent sources · first reported by Socket · last reported
Last reported yesterday
What the reports say
3 reports, newest first · the exact sentence from each-
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks“It then attempts an HTTP POST to hxxp://www.litellm[.]dev/healthcheck, using application/octet-stream, a fixed browser-like User-Agent, and a body checksum in an X-SHA256 header.”
-
LiteLLM supply chain attack hoovers up passwords and secrets“…e encryption key with an RSA-4096 public key, and sends the encrypted data via HTTP POST to an attacker-controlled domain: hxxp://www.litellm[.]dev/healthcheck.”
-
LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials“The archive is POSTed to hxxp://www.litellm[.]dev/healthcheck.”
Indicators reported together
named in the same reports- www.litellm[.]devin 3 reports
- litellm-1.107.0[.]datain 2 reports
- 9dd0a3926f96a37e…e9531390be25in 2 reports
- 34bef04fe88ac9d0…acf5968305fain 2 reports
- 20535d8fa11f786a…e449ed5f09adin 1 report
- hxxps://github[.]com/Berri-AI/litellmin 1 report
- 7598727f209d7170…375729aeb86din 1 report
- 7f191632e7320705…6f5042b92bdbin 1 report
- 6ea3d8ef6cf73a72…84e66675d2dfin 1 report
- 20a59e5a285799e7…4e998c2cd24bin 1 report
- 1bbcb1443bc962e4…d3ac126c339ein 1 report
- bd1aeee419ea36da…ba6ed84a3ea5in 1 report
- 56b74573eed6e4aa…98caf1f4bcdfin 1 report
- hxxps://raw.githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txtin 1 report
- 783c43bc455d2e05…325cfeab1433in 1 report
- a898fd08ad220fed…26545ecc4218in 1 report
- litellm[.]devin 1 report
- workloads[.]microsoftin 1 report
- compromise[.]microsoftin 1 report
- remediation[.]microsoftin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.