LiteLLM supply chain attack hoovers up passwords and secrets

What happened: Unknown attackers compromised LiteLLM's release process on Wednesday and distributed malicious version 1.107.0 via PyPI and Docker registries. It contained an infostealer and a remote access trojan. Key numbers: Malicious version uploaded at 11:39 UTC. Why it matters: Anyone who ran the compromised package or the official Docker image should assume their secrets have been stolen. Aikido, Wiz, and Socket published threat-hunting and mitigation instructions, and Socket said teams using 1.107.0 should stop deploying it and investigate affected environments.

Unknown attackers compromised LiteLLM's release process on Wednesday and distributed malicious version 1.107.0 via PyPI and Docker registries. It contained an infostealer and a remote access trojan.

Anyone who ran the compromised package or the official Docker image should assume their secrets have been stolen. Aikido, Wiz, and Socket published threat-hunting and mitigation instructions, and Socket said teams using 1.107.0 should stop deploying it and investigate affected environments.