litellm sensitivity with my `box` script


        
            
                Markdown 4.40 KB
                                    
                        | None                    
                
                                        |
    0    0                            

            
                
                                    raw
                    download
                    clone
                    embed
                    print
                
                                    report
                
                
                            
        
        
            LiteLLM infostealer
I run everything via my bwrap script box and check the following
System information including hostname, username, OS version, running processes, and network interfaces
> hostname
sandbox
> echo $USER
bvdeenen
> uname -a
Linux sandbox 7.2.9_1 #1 SMP PREEMPT_DYNAMIC Sun Oct  4 02:53:42 UTC 2026 x86_64 GNU/Linux
> ps aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
bvdeenen       1  0.0  0.0   2632  1292 ?        S    14:49   0:00 bwrap --die-with-parent --unshare-pid --unshare-uts --unshare-cgroup
bvdeenen       2  0.0  0.0  11780  8760 ?        S    14:49   0:00 bash
bvdeenen     407  0.0  0.0   7320  3768 ?        R+   14:57   0:00 ps aux
> ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host proto kernel_lo
       valid_lft forever preferred_lft forever
2: enp196s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
    link/ether 38:f7:cd:d4:2a:b3 brd ff:ff:ff:ff:ff:ff
…
Saved passwords from Chromium-based browsers (Chrome, Edge, Brave, Vivaldi, Opera) including AES-decrypted password values, and browsing history from those same browsers
> ls -l ~/.config/
total 16
drwxr-x--x 2 bvdeenen 1001 4096 Nov  1  2023 gh
drwxr-xr-x 2 bvdeenen 1001 4096 Oct  3  2025 git
drwxr-xr-x 8 bvdeenen 1001 4096 Aug  8 15:06 nvim
drwxr-xr-x 4 bvdeenen 1001 4096 May 15  2024 plasma-workspace
Firefox saved credentials: same as google-chrome
SSH private keys from ~/.ssh/
> ls -l ~/.ssh
ls: cannot access '/home/bvdeenen/.ssh': No such file or directory
Shell history from Bash, Zsh, and Fish.
> ls -l ~/.bash*
-rw-r--r-- 1 bvdeenen 1001 4377 Oct  4 21:38 /home/bvdeenen/.bashrc
-rw-r--r-- 1 bvdeenen 1001    0 Aug 14 16:10 /home/bvdeenen/.bashrc.sandbox
-rw-r--r-- 1 bvdeenen 1001  143 Oct 26 14:49 /home/bvdeenen/.bash-startup-log
Cloud provider credentials including AWS credentials files and config, Azure authentication tokens and MSAL cache, and GCP application default credentials. It also queries the live instance metadata endpoints for AWS, GCP, and Azure to extract credentials available to the running instance.
> env
COLORTERM=1
NVM_INC=/home/bvdeenen/.nvm/versions/node/v22.19.0/include/node
RIPGREP_CONFIG_PATH=/home/bvdeenen/.config/ripgreprc
PWD=/home/bvdeenen/dev
MANPATH=/home/bvdeenen/.nvm/versions/node/v22.19.0/share/man:/usr/local/share/man:/usr/share/man:/home/bvdeenen/.local/share/man
HOME=/home/bvdeenen
LS_COLORS=...
LC_LANG=en_US.utf8
NVM_DIR=/home/bvdeenen/.nvm
TERM=xterm-color
USER=bvdeenen
SDKMAN_DIR=/home/bvdeenen/.sdkman
SHLVL=1
NVM_CD_FLAGS=
PS1=>
_KDE_APPLICATIONS_AS_FORKING=1
LC_ALL=en_US.utf8
PATH=/home/bvdeenen/.grok/bin:/home/bvdeenen/.nvm/versions/node/v22.19.0/bin:/home/bvdeenen/anaconda3/bin:/home/bvdeenen/bin:/home/bvdeenen/.local/bin:/home/bvdeenen/binaries/zig:/usr/local/bin:/usr/bin
NVM_BIN=/home/bvdeenen/.nvm/versions/node/v22.19.0/bin

#Note: most of the directories in the PATH don't exist for the sandbox.
Docker config files and Docker Swarm secrets: zie env
Kubernetes service account tokens: zie env
CI/CD secrets including GitLab runner configs, Jenkins admin passwords and master keys, and HashiCorp Vault tokens: zie env
Developer tool credentials and configuration files for Claude Code, Claude Desktop, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Amazon Q, Codex CLI, Aider, Continue, HuggingFace, and others
Git credentials, .npmrc, .pypirc, and pip config files
GPG private keys and TLS private keys
All environment variables from the current process and, on Linux, from every other running process via /proc/<pid>/environ

The contents of the LiteLLM database directly, including all rows from LiteLLM_CredentialsTable (stored API keys for every provider) and LiteLLM_ProxyModelTable (model configurations)
> ls -ld /proc/[0-9]
dr-xr-xr-x 9 bvdeenen 1001 0 Oct 26 14:49 /proc/1
dr-xr-xr-x 9 bvdeenen 1001 0 Oct 26 14:49 /proc/2

> cat /proc/1/cmdline
bwrap--die-with-parent--unshare-pid...
> cat /proc/2/cmdline

# proc/1 is my `box` script