[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faD4wsDmk9eUIOintkZTZr5WDLV3BYVkRvxJ8xEpfXkk":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"02ca06de-8272-490e-8be6-d5ef70988a9c","litellm-master-key-exposure-enables-supply-chain-attack-via-pypi","c8caef8e-dba3-4920-9d53-737f99f10ee6","LiteLLM Master Key Exposure Enables Supply Chain Attack via PyPI","A developer accidentally committed a master key to a public GitHub repository, granting an attacker owner-level access to LiteLLM's entire GitHub organization. With that access, the attacker injected an infostealer and remote access trojan into version 1.107.0 of the LiteLLM PyPI package, potentially compromising credentials and API keys of every downstream user who installed it. This incident illustrates how a single secret exposure can cascade into a full supply chain compromise affecting thousands of consumers. Secrets in source code are a well-documented, preventable risk that automated scanning tools can catch before they ever reach a public repository.","**Immediate actions:**\n- Rotate or revoke all exposed secrets immediately and audit all repository access logs for unauthorized activity since the key was first committed.\n- Remove the compromised package version from PyPI and notify downstream users to upgrade and rotate any credentials loaded during the affected period.\n\n**Long-term improvements:**\n- Enforce pre-commit hooks and CI\u002FCD pipeline secret-scanning (e.g., GitHub Advanced Security, Gitleaks, or Trufflehog) to block secrets from ever being pushed to any repository.\n- Apply least-privilege principles to repository tokens and API keys so that no single credential grants owner-level access to the entire GitHub organization.\n- Implement mandatory code-signing and provenance attestation (e.g., SLSA framework) for all packages published to PyPI or other registries.\n\n**Detection measures:**\n- Configure real-time alerting on any new repository collaborator additions or permission escalations within the GitHub organization.\n- Monitor PyPI release pipelines for unexpected file changes or new binaries introduced between release commits and the published artifact.",[12,13,14,15,16,17,18],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires entities to implement incident handling and supply chain security measures; LiteLLM's failure to prevent secret exposure and detect the malicious package injection before distribution represents a gap in both requirements.","The attacker's initial foothold via an exposed credential is analogous to credential theft techniques catalogued in ATT&CK; specifically, the subsequent repository takeover mirrors T1195 (Supply Chain Compromise), highlighting the need for integrity controls across the software delivery pipeline.","Timely detection and removal of the exposed secret, combined with rapid revocation and re-issuance, aligns with SI-2's requirement to identify and correct software and configuration flaws promptly.","Downstream consumers installing the trojanized LiteLLM package were unknowingly using a compromised component, which is precisely the risk OWASP A06 addresses by requiring verification of component integrity and provenance.","This control requires organizations to identify and remediate technical vulnerabilities in a timely manner; automated secret-scanning in CI\u002FCD would have surfaced the committed key as a vulnerability before it was exploited.","Proper secret management practices—keeping credentials out of source code and using environment variables or vaults—fall under secure configuration and would have prevented the master key from being exposed in the public repository.","Applying least-privilege to the master key so it did not carry owner-level GitHub organization access would have dramatically limited the blast radius when the credential was exposed.","published","2026-10-26T21:20:26.719187+00:00","2026-10-26T21:20:26.702+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.theregister.com\u002Fsecurity\u002F2026\u002F10\u002F26\u002Flitellm-supply-chain-attack-started-with-an-exposed-master-key\u002F5305544","litellm-supply-chain-attack-started-with-an-exposed-master-key-3bd252","LiteLLM supply chain attack started with an exposed master key",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"de07003e-e970-4157-814e-2e1ac65073a8","2026-10-27","morning","ThreatNoir Morning Brief — October 27","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-27\u002Fthreatnoir-morning-brief-2026-10-27.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]