Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker.
LiteLLM Compromised in Fresh Supply Chain Attack
About this summary. This is a short excerpt from the description that SecurityWeek published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.securityweek.com/litellm-compromised-in-fresh-supply-chain-attack/
Source attribution: headline and facts are from SecurityWeek (securityweek.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
New LiteLLM Supply Chain Attack Hits PyPI and Docker
A new LiteLLM supply chain attack has turned version 1.107.0, an official release of the popular open-source LLM gateway, into a credential stealer. On October 21, 2026…
Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
Attack overview Technical details Mitigation and protection guidance Indicators of compromise References Learn More On October 21, 2026, a compromised LiteLLM 1.107.0…
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI…
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a…
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to…
'Gheist' Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories.