[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWWjV0RAeq_IZhckL9hj_PmZ225UIclWinMDPI3fcR-8":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"bf0a2b72-b699-4138-8206-d6a72369cd78","LiteLLM Compromised in Fresh Supply Chain Attack","litellm-compromised-in-fresh-supply-chain-attack-01e5ec","Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek.","LiteLLM, a popular open-source LLM proxy, was compromised in a supply chain attack on October 21st. Attackers used leaked GitHub CLI OAuth tokens to push malicious version 1.107.0 to PyPI and Docker, which was downloaded over 49,000 times before being removed. The malware acts as an information stealer and RAT, targeting cloud secrets, API keys, and credentials.","LiteLLM supply chain attack serves malware via compromised PyPI and Docker packages.","https:\u002F\u002Fwww.securityweek.com\u002Flitellm-compromised-in-fresh-supply-chain-attack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002Fsupply-chain-attack.jpeg","2026-10-23T08:10:46+00:00","2026-10-23T10:00:05.074179+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":19},"Claude Code",{"name":23,"type":24},"GitHub CLI OAuth tokens","technology",{"name":26,"type":24},"LLM",{"name":28,"type":24},"RAT",{"name":30,"type":31},"Berri-AI","vendor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[30,18,21],{"controls":58,"vendors":137},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":89,"name":90,"problem":91,"products":92},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,123,129],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":124,"product_name":125,"url":127,"description":128},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[],{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":150},"litellm-supply-chain-attack-exposes-dangers-of-leaked-oauth-tokens","LiteLLM Supply Chain Attack Exposes Dangers of Leaked OAuth Tokens","Attackers leveraged leaked GitHub CLI OAuth tokens to gain unauthorized access to LiteLLM's publishing pipeline, injecting malicious code into version 1.107.0 before it was distributed via PyPI and Docker. This attack highlights how a single compromised credential in a CI\u002FCD or development toolchain can cascade into a wide-scale supply chain compromise, affecting over 49,000 downloads. The malware functioned as both an information stealer and a Remote Access Trojan (RAT), specifically targeting cloud secrets and API keys — high-value assets in AI\u002FLLM-driven environments. This incident underscores that open-source ecosystems are high-value targets, and that token hygiene and pipeline integrity controls are no longer optional.",[143,144,145,146,147,148,149],"CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":151,"MITRE ATT&CK T1566: Phishing":152,"NIST SP 800-53 SI-2: Flaw Remediation":153,"OWASP A06:2021 Vulnerable and Outdated Components":154,"CIS Control 7: Continuous Vulnerability Management":155,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":156,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":157},"NIS2 mandates supply chain security measures including assessments of software supplier practices, which would require controls like package signing and CI\u002FCD access governance that were absent here.","While the initial vector was a leaked token rather than phishing, the broader ATT&CK supply chain technique (T1195) is directly applicable, as attackers compromised a trusted software distribution channel to deliver malware to downstream users.","Organizations consuming LiteLLM should have had processes to rapidly identify, remove, and replace the compromised package version across all affected systems.","This attack directly exploits the risk of consuming unverified third-party components; organizations without integrity verification processes unknowingly installed the trojanized package.","Continuous monitoring of third-party dependencies and package versions would have flagged the unexpected malicious release of LiteLLM 1.107.0 before widespread installation.","A formal process for tracking and vetting third-party software components would have included integrity checks that could detect the tampered LiteLLM release before deployment.","The attack succeeded because a leaked OAuth token was not detected and revoked in time; strong identity controls and token lifecycle management would have prevented the attacker from publishing to PyPI and Docker."]