🏆 New Achievement! Patch Notes From Hell!
v[COMPROMISED] — ADDED: credential-stealing malware, bundled free with your LiteLLM update. FIXED: the developers' trust in their own release pipeline (it's not fixed). KNOWN ISSUE: anything you typed into that installation is now someone else's problem.
Attackers breached LiteLLM's release pipeline and weaponized it to push malware targeting credentials directly to users who pulled affected versions. Your supply chain is not a feature. (1/2)
It is a loading screen for the bad guys.
Rotate any API credentials exposed on systems running LiteLLM, audit your installations, and watch for suspicious outbound traffic. Operator action required; the update button is not your friend today.
Reward: You've received a Cursed Dependency — soulbound, untradeable, already installed.
#SupplyChainAttack #Malware (2/2)
CSO OnlineLiteLLM release pipeline hacked to distribute credential-stealing malwareAttackers used stolen GitHub credentials to push a backdoored version of the popular AI gateway, exposing cloud, Kubernetes, and CI/CD secrets.
