Attackers compromised the release process of LiteLLM, the popular Python library and gateway for accessing AI models, and on 21 October published an infected version 1.107.0 to PyPI, Docker Hub and GHCR. The packages contained malicious files that ran every time Python started and collected cloud credentials, AI keys, .env files, SSH keys and browser data. The versions were available for about two hours before being removed. The project advises reverting to version 1.106.2, isolating and rebuilding affected systems and rotating every secret.

What it means: LiteLLM sits as a middle layer between applications and model providers, so it lives exactly where a company's most valuable keys are concentrated. That is what makes this attack so damaging: a single automatic upgrade was enough to leak cloud credentials, access to code repositories and keys for AI services. For Greek development teams building AI into their products, the incident raises again the question of how dependencies get installed. Pinning versions with hashes, avoiding tags such as latest in production and waiting a short time before adopting each new release all cut the risk sharply. It is just as important that build and production environments hold no more permissions than they need, so a stolen key opens few doors. The malicious code even fired when someone ran Python to inspect the machine, which means incident response has to start from a clean environment. For companies under NIS2, managing software supply-chain risk is an explicit obligation, and incidents like this are the practical case their procedures should cover.

Read the original on BleepingComputer

Related service: Custom software

Related stories