Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks | Microsoft Security Blog
· Source: microsoft.com
In short
On October 21, 2026, a compromised LiteLLM 1.107.0 package was distributed via PyPI and container images, enabling automatic execution of malicious code through Python startup hooks. This code collected credentials across developer tools, AI applications, cloud environments, browsers, and infrastructure, encrypted them, and exfiltrated the data. Microsoft provided detailed technical analysis, mitigation guidance, detection methods, and indicators of compromise to defend affected environments.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 43, 2026: Amazon plans faster at scale as one customer cuts 52-week planning time 40%
Tags: supply chain, credential theft, python, security, supply chain attack, exfiltration