LiteLLM open-source gateway compromised with credential-stealing malware in second supply chain attack

Attackers compromised LiteLLM's release pipeline and published version 1.107.0 to the PyPI package repository carrying credential-stealing malware, according to CSO Online and Wired. It is the second supply chain attack on the open-source AI gateway project within a single year, exposing enterprise deployments that use LiteLLM for model API management and governance.

LiteLLM open-source gateway compromised with credential-stealing malware in second supply chain attack According to CSO Online and Wired, attackers compromised LiteLLM's release pipeline and distributed version 1.107.0 with credential-stealing malware via PyPI package repository. This marks the second supply chain attack on the open-source AI gateway project within a single year, exposing enterprise deployments that rely on LiteLLM for model API management and governance. Topics Sources - Press Read article https://www.csoonline.com/article/4239033/litellm-release-pipeline-hacked-to-distribute-credential-stealing-malware - Press Read article https://www.wired.com/story/ai-guardrails-arent-stopping-criminal-hackers/ Go deeper This intelligence is sourced automatically from public sources across the web and synthesised by the Prefactor AI pipeline. Stories are reviewed before publication.