Threat campaign2 publishers
Exploitation
LiteLLM supply chain attack started with an exposed master key
A 'strong illustration of the risks associated with failing to rotate a potentially exposed key'
The Register +1
LiteLLM compromise
October 2026
Threat campaign
Major event · Exploitation
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]
Bleeping Computer
Read reportThreat campaign
Major event · Exploitation
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.
The Hacker News
Read reportEnd of archive.