[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOdkLWHaSOkSzvuyHK44YebWECbopaomk4rntsf-db3Q":3},{"article":4,"iocs":53,"watch_terms":62,"solutions":63,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"9c798122-d35f-4e6f-9eb0-8c7d3c023dff","LiteLLM release pipeline hacked to distribute info-stealer malware","litellm-release-pipeline-hacked-to-distribute-info-stealer-malware-37f563","Hackers compromised the LiteLLM project's PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. [...]","Hackers compromised the LiteLLM project's release pipeline, injecting malware into version 1.107.0 distributed via PyPI wheels and Docker Hub\u002FGHCR images. The info-stealer payload targeted cloud credentials, AI provider tokens, developer secrets, and browser data, affecting the massively popular open-source SDK used by NVIDIA, Netflix, AT&T, and Okta. The attack was detected within six minutes and malicious artifacts were rapidly removed, but users must isolate systems, rotate secrets, and rebuild from clean backups.","LiteLLM PyPI package and Docker images compromised to distribute info-stealer malware","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Flitellm-release-pipeline-hacked-to-distribute-info-stealer-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F22\u002FLiteLLM.jpg","2026-10-22T19:12:51+00:00","2026-10-22T20:00:04.78765+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":22},"PyPI","technology",{"name":24,"type":22},"Docker Hub",{"name":26,"type":22},"GHCR",{"name":28,"type":29},"NVIDIA","vendor",{"name":31,"type":29},"Netflix","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"hash_sha256","1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e","Malicious Docker image hash for LiteLLM v1.107.0 on Docker Hub and GHCR",{"type":59,"value":60,"context":61},"domain","litellm.dev","C2 exfiltration endpoint for encrypted stolen data (\u002Fhealthcheck path)",[28,31,18],{"controls":64,"vendors":142},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":124,"name":125,"problem":126,"products":127},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[128,136,137],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":138,"product_name":139,"url":140,"description":141},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":155},"litellm-release-pipeline-compromised-to-deliver-credential-stealing-malware","LiteLLM Release Pipeline Compromised to Deliver Credential-Stealing Malware","Attackers gained access to LiteLLM's CI\u002FCD release pipeline and injected an info-stealer into a published PyPI package and container images, targeting cloud credentials, AI provider tokens, and developer secrets. This is a textbook software supply chain attack: by compromising the build and distribution infrastructure rather than the source code itself, the threat actors bypassed most traditional code review controls. The fact that the malicious release reached PyPI and Docker Hub before detection illustrates how trusted distribution channels can be weaponised against downstream users at scale. Because LiteLLM is used by organisations like NVIDIA, Netflix, and Okta, the blast radius of even a short-lived compromise is enormous. It underscores that securing the pipeline — including secrets, signing keys, and publishing credentials — is as critical as securing the application code.",[148,149,150,151,152,153,154],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","CIS Control 17: Incident Response Management","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components",{"MITRE ATT&CK T1566: Phishing":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"CIS Control 17: Incident Response Management":158,"OWASP A06:2021 Vulnerable and Outdated Components":159,"CIS Control 7: Continuous Vulnerability Management":160,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":161,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":162},"While the exact initial access vector is unconfirmed, compromised pipeline credentials are frequently obtained via phishing of developer accounts; addressing this vector through phishing-resistant MFA on all pipeline identities directly limits attacker entry.","SI-2 requires organisations to identify, report, and correct flaws in information systems, including the build and release infrastructure used to distribute software to end users.","The six-minute detection and rapid artefact removal demonstrate the value of a prepared incident response plan; formalising this into a documented, rehearsed supply-chain incident playbook ensures consistent and faster response across future events.","This risk category explicitly covers the danger of consuming third-party packages that may be tampered with or malicious, making signature verification and provenance checks on all open-source dependencies a core mitigation directly applicable to this incident.","Continuous scanning of the CI\u002FCD toolchain and its dependencies would have identified misconfigurations or exposed credentials in the pipeline before attackers could exploit them to inject malware.","This control requires systematic management of technical vulnerabilities across all systems in scope, including CI\u002FCD pipelines and the third-party tooling used to build and publish software.","Restricting and tightly controlling the identities (service accounts, tokens) authorised to publish to PyPI and container registries would have limited an attacker's ability to push malicious artefacts even after gaining initial access."]