{"slug": "litellm-supply-chain-attack-hoovers-up-passwords-and-secrets", "title": "LiteLLM supply chain attack hoovers up passwords and secrets", "summary": "A supply chain attack on LiteLLM, the open-source proxy for large language model APIs, stole passwords and secrets from affected users, The Register reported. The compromise of the package's distribution channel let attackers harvest credentials from environments running the tool, exposing secrets used to reach LLM providers. The incident matters because LiteLLM is widely deployed in AI application stacks, turning a routine dependency into a credential-theft vector.", "body_md": "### [AI](https://beta.theregister.com/tag/ai)\n\n- \n#### Jensen Huang sends in the robot ducks to sell Nvidia's AI-everywhere visionContainerized datacenters, androids, and telecoms all feature in Berlin keynote interrupted by environmental protesters\n- \n#### Nvidia's grand plan for speeding up datacenter deployments: AI trailer parksGPUzilla boasts modular bit barns could speed up deployments from six months to just two weeks\n- \n#### The spec is the new code, so brush up on your prose, says Kaseya CTODomain expertise and clear writing will matter more than syntax, and yes, that means documentation\n- \n#### Happiness is the next AI KPI if Oxford boffins have their wayResearchers say public subsidies for AI should be repaid in wellbeing, not just economic growth\n- \n#### MPs urge UK government to play venture capitalist with taxpayer-funded techWatchdog says Whitehall is too timid about taking stakes in British startups, leaving taxpayers at risk of missing out when they strike gold\n\n### [Infosec](https://beta.theregister.com/security)\n\n- \nSecurity #### Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!\n- \nSecurity #### Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more\n- \nBlack Hat and DEF CON #### DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included\n- \nSecurity #### EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified\n- \nMalware Month #### Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career\n\n### [FOSS](https://beta.theregister.com/tag/FOSS)\n\n- \n#### Red Hat helps teach about tech writingBut learns tough lessons about AI in the process\n- \n#### NetBSD may have found a new role: The AI-free FOSS OSIncreasing awareness and adoption, followed by increasing donations\n- \n#### OpenAI dots inspire open source imitators amid technical difficultiesPersistent agents appeal to AI companies, but demand isn't obvious\n- \n#### Ubuntu 'Stonking Stingray' beta swims out: Deeper Rust 'oxidization' plus LLM speech-to-textGNOME 51 is here, and Ubuntu interim releases are getting interesting again\n- \n#### Revive Raskin's 3 laws of software with humane work that considers a dev's duty of careAll this, and angry NeoVim users\n- \n#### Firefox 157: Could bold new look be just what Mozilla needs?*Yet another new version of Firefox, with a significant reskin", "url": "https://wpnews.pro/news/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets", "canonical_source": "https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548", "published_at": "2026-10-21 18:22:20+00:00", "updated_at": "2026-10-21 18:41:15.504825+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "developer-tools", "large-language-models", "artificial-intelligence"], "entities": ["LiteLLM", "The Register"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets", "markdown": "https://wpnews.pro/news/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets.md", "text": "https://wpnews.pro/news/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets.txt", "jsonld": "https://wpnews.pro/news/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets.jsonld"}}