LiteLLM Compromised in Fresh Supply Chain Attack
Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.
Excerpt from the primary source: SecurityWeek
Who is affected
Enterprises · Developers
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables.
Machine speed attacks require machine speed detection and response
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical.
OVHcloud GitHub Compromise Tied to GlassWorm Threat Actors
A developer's GitHub account that was compromised several months earlier was used to push malicious code to unsuspecting users.
OVHcloud CLI releases backdoored on GitHub to steal developer secrets
French cloud and hosting provider OVHcloud is warning users that attackers compromised its open-source command-line interface (CLI) tool to distribute information-stealing malware.