/
data_types_exposed:cloud_secrets × victim_sectors:"software development" × criticity:critical × limpar

Resultados

2 casos · pág. 1/1

securityweek.com · critical

LiteLLM 1.107.0 poisoned on PyPI and Docker in supply chain attack via stolen GitHub CLI tokens

On October 21, attackers published a malicious LiteLLM version 1.107.0 to PyPI and Docker Hub. LiteLLM is a widely used open source proxy for routing requests across LLM providers. The packages were live for about three hours and were downloaded an estimated 49,000+ times before being removed or repointed to clean artifacts. They install …

technology software development
bleepingcomputer.com · · 7 fontes · 8 atualizações critical

LiteLLM 1.107.0 trojanized on PyPI and Docker via stolen GitHub CLI tokens: infostealer and RCE backdoor through Python startup hooks

The LiteLLM release 1.107.0 (a widely used open source LLM proxy and AI gateway developed by BerriAI, about 23 million weekly downloads per theregister.com and gbhackers.com, or about 92 million monthly PyPI downloads per bleepingcomputer.com) was trojanized on PyPI on 21 October 2026 and carries a credential stealer (privcollect) plus a …

technology software