LiteLLM Compromised in Fresh Supply Chain Attack
· Source: securityweek.com
In short
LiteLLM was compromised in a supply chain attack on October 21, with malicious version 1.107.0 packages served on PyPI and Docker Hub for roughly three hours and downloaded over 49,000 times. Attackers abused stolen GitHub CLI OAuth tokens—likely leaked via Claude Code logs—to disable branch protections and publish poisoned artifacts from a lookalike repository. The payload combines an information stealer harvesting cloud and AI API credentials with a RAT, and Wiz observed signs of LLMjacking against Amazon Bedrock using stolen AWS credentials.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 43, 2026: Amazon plans faster at scale as one customer cuts 52-week planning time 40%
Tags: supply chain, cybersecurity, open source, malware, LLM infrastructure, credentials