[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fztM8nektN79IFY363La5v09hPNw_S1Yh5ZgMVKk_oz8":3},{"article":4,"iocs":59,"watch_terms":63,"solutions":64,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"78e06723-4560-4327-8cde-58efeeaad753","Popular AI tool LiteLLM says unrevoked key allowed hackers to target users","popular-ai-tool-litellm-says-unrevoked-key-allowed-hackers-to-target-users-bab6fc","LiteLLM, an open-source tool widely used by artificial intelligence developers, said a key accidentally exposed in May was behind a supply-chain attack that is believed to have hit tens of thousands of users last week.","LiteLLM, a popular open-source AI development tool, suffered a supply-chain attack after an API key accidentally exposed in May was not revoked. An attacker used the key to gain control of LiteLLM's GitHub repositories and distribute a malicious version (1.107.0) containing credential-harvesting malware via PyPI that was downloaded approximately 49,000 times. The stolen cloud credentials were immediately tested for unauthorized access to AWS AI services, consistent with \"LLMjacking\" attacks designed to exploit victim accounts.","LiteLLM supply-chain attack exploited unrevoked API key to distribute credential-stealing malware to ~49K users.","https:\u002F\u002Ftherecord.media\u002Flitellm-hackers-ai-malware","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FLite_LLM_be1a113cd2.jpg","2026-10-26T12:00:00+00:00","2026-10-26T13:00:09.654272+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"LiteLLM","product",{"name":21,"type":19},"Python Package Index (PyPI)",{"name":23,"type":24},"GitHub","technology",{"name":26,"type":27},"Google (Wiz)","vendor",{"name":29,"type":27},"Amazon AWS",{"name":31,"type":32},"TeamPCP","threat_actor","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":33,"icon":35,"name":36,"slug":37},null,"Supply Chain","supply-chain",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":55},{"id":56,"icon":35,"name":57,"slug":58},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[60],{"type":53,"value":61,"context":62},"LiteLLM v1.107.0 (compromised package)","Malicious version distributed via PyPI containing credential-harvesting malware; downloaded ~49,000 times",[26,29,18],{"controls":65,"vendors":145},[66,95,121],{"slug":67,"name":68,"problem":69,"products":70},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":96,"name":97,"problem":98,"products":99},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":117,"product_name":118,"url":119,"description":120},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"slug":122,"name":123,"problem":124,"products":125},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[126,134,139],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":135,"product_name":136,"url":137,"description":138},"jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":140,"product_name":141,"url":143,"description":144},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":164},"unrevoked-api-key-enables-litellm-supply-chain-attack-49k-malicious-downloads","Unrevoked API Key Enables LiteLLM Supply-Chain Attack, 49K Malicious Downloads","An API key accidentally exposed in May was never revoked, giving an attacker persistent, privileged access to LiteLLM's GitHub repositories months later. This single oversight allowed the adversary to poison a widely-used open-source package on PyPI, resulting in approximately 49,000 downloads of credential-harvesting malware. The stolen cloud credentials were immediately weaponized to access AWS AI services — a pattern known as LLMjacking — amplifying the damage far beyond the initial compromise. This incident illustrates that a leaked secret left unrevoked is functionally equivalent to handing an attacker a permanent key to your infrastructure.",[157,158,159,160,161,162,163],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components","CIS Control 17: Incident Response Management",{"MITRE ATT&CK T1566: Phishing":165,"CIS Control 5: Account Management":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"CIS Control 17: Incident Response Management":168,"OWASP A06:2021 Vulnerable and Outdated Components":169,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":170,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":171},"While not phishing directly, the attacker's technique of distributing a malicious package to harvest credentials maps to supply-chain compromise methods that abuse trusted channels — analogous to the deceptive delivery mechanism ATT&CK tracks under credential access via trojanized software.","The incident stemmed from a failure to revoke a compromised credential; CIS Control 5 requires organizations to actively manage the lifecycle of all credentials, including immediate revocation of exposed secrets.","Failing to revoke the exposed key is analogous to leaving a known vulnerability open; SI-2 requires organizations to remediate identified weaknesses — including credential exposures — within defined timeframes.","The failure to act on the May key exposure before it led to a full supply-chain attack highlights the absence of a structured incident response process; CIS Control 17 requires organizations to establish and exercise response procedures so that identified exposures are escalated and remediated promptly.","The 49,000 users who downloaded the poisoned LiteLLM package were exposed because they consumed a compromised third-party component without integrity verification, which A06 specifically addresses by requiring controls around third-party and open-source software supply chains.","The exposed API key represented a known technical weakness that was not remediated, violating the requirement to identify and address vulnerabilities in a timely manner before they can be exploited.","The unrevoked API key provided ongoing unauthorized access to critical repositories; PR.AA calls for managing credentials and access rights to prevent exactly this kind of persistent privilege abuse."]