LiteLLM open-source gateway compromised with credential-stealing malware in second supply chain attack

According to CSO Online and Wired, attackers compromised LiteLLM's release pipeline and distributed version 1.107.0 with credential-stealing malware via PyPI package repository. This marks the second supply chain attack on the open-source AI gateway project within a single year, exposing enterprise deployments that rely on LiteLLM for model API management and governance.

Topics #

Sources #

- Press[Read article](https://www.csoonline.com/article/4239033/litellm-release-pipeline-hacked-to-distribute-credential-stealing-malware)
- Press[Read article](https://www.wired.com/story/ai-guardrails-arent-stopping-criminal-hackers/)

Go deeper #

This intelligence is sourced automatically from public sources across the web and synthesised by the Prefactor AI pipeline. Stories are reviewed before publication.