LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
-
The LiteLLM Python package has been compromised in a software supply chain attack that delivered a credential stealer and a backdoor, according to findings from SafeDep, Socket, StepSecurity, and Upwind.
The affected release is LiteLLM 1.107.0, which was distributed through PyPI wheels and Docker images. The package has since been quarantined on the Python Package Index (PyPI).
If your environment pulled this version, treat any credentials accessible to it as potentially exposed and review your dependency lockfiles and container images for the affected release.
Source: The Hacker News
Has your organization pinned or deployed LiteLLM 1.107.0, and if so, what steps are you taking to rotate credentials and verify your images?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login