LiteLLM supply chain attack hoovers up passwords and secrets
6 Articles
6 Articles
A malicious version of LiteLLM, distributed through PyPI and Docker, incorporated tools to steal cloud credentials, AI service keys and other secrets, as well as allowing remote command execution. The teams that executed it should treat their environments as potentially compromised and initiate an investigation.
Stolen LiteLLM Credentials From March Hack Surface in 153GB Leak
CloudSEK's reconstructed archive contains 433,909 files from 2,488 organizations, including Nvidia, AWS, Cisco, Samsung and Siemens, with many credentials still valid five months after the breach. The FBI's July 2 advisory urged immediate rotation of CI/CD secrets and cloud tokens.
LiteLLM Compromised - Hackers Injected an Infostealer and RAT in the Latest 1.107.0 PyPI Release
LiteLLM version 1.107.0 was compromised on PyPI on October 21, 2026, spreading a credential stealer and a remote access trojan through all seven distributed wheel files. The malicious release also reached Docker images, putting developer systems, build runners, and AI services at risk. Aikido warned that anyone who installed the affected release should assume credentials […]
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
