supply-chain
Imported story
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Source: The Hacker News · Published · Last checked 1 day ago · 1 min read
Read original source ↗ (thehackernews.com)
Publisher excerpt From The Hacker News
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a backdoor. On October 21, 2026, LiteLLM's release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place around 4:00 a.m.
Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.