[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fboKpoFAxvbOn-cmQQYnPAnzPppy151C97xo4Y7SV2zo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"b60d613a-c061-4f8f-be83-a73fa4335bc7","litellm-supply-chain-attack-exposes-dangers-of-leaked-oauth-tokens","bf0a2b72-b699-4138-8206-d6a72369cd78","LiteLLM Supply Chain Attack Exposes Dangers of Leaked OAuth Tokens","Attackers leveraged leaked GitHub CLI OAuth tokens to gain unauthorized access to LiteLLM's publishing pipeline, injecting malicious code into version 1.107.0 before it was distributed via PyPI and Docker. This attack highlights how a single compromised credential in a CI\u002FCD or development toolchain can cascade into a wide-scale supply chain compromise, affecting over 49,000 downloads. The malware functioned as both an information stealer and a Remote Access Trojan (RAT), specifically targeting cloud secrets and API keys — high-value assets in AI\u002FLLM-driven environments. This incident underscores that open-source ecosystems are high-value targets, and that token hygiene and pipeline integrity controls are no longer optional.","**Immediate actions:**\n- Rotate all OAuth tokens, API keys, and CI\u002FCD credentials associated with the compromised repository immediately and audit recent publish events.\n- Scan all environments that installed LiteLLM version 1.107.0 for indicators of compromise, stolen credentials, and unauthorized remote access.\n\n**Long-term improvements:**\n- Enforce short-lived, scoped tokens for all CI\u002FCD pipelines and implement token revocation monitoring to detect leaked credentials in real time.\n- Require cryptographic signing of all published packages (e.g., using Sigstore\u002Fcosign) so consumers can verify artifact integrity before installation.\n- Implement a software bill of materials (SBOM) process and dependency pinning to detect unexpected changes in third-party packages before deployment.\n\n**Detection measures:**\n- Deploy continuous monitoring on package registries and internal artifact repositories to alert on unexpected version publishes or metadata changes.\n- Integrate runtime secrets scanning in cloud environments to detect exfiltration of API keys and cloud credentials as an early warning of RAT activity.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":20,"MITRE ATT&CK T1566: Phishing":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 mandates supply chain security measures including assessments of software supplier practices, which would require controls like package signing and CI\u002FCD access governance that were absent here.","While the initial vector was a leaked token rather than phishing, the broader ATT&CK supply chain technique (T1195) is directly applicable, as attackers compromised a trusted software distribution channel to deliver malware to downstream users.","Organizations consuming LiteLLM should have had processes to rapidly identify, remove, and replace the compromised package version across all affected systems.","This attack directly exploits the risk of consuming unverified third-party components; organizations without integrity verification processes unknowingly installed the trojanized package.","Continuous monitoring of third-party dependencies and package versions would have flagged the unexpected malicious release of LiteLLM 1.107.0 before widespread installation.","A formal process for tracking and vetting third-party software components would have included integrity checks that could detect the tampered LiteLLM release before deployment.","The attack succeeded because a leaked OAuth token was not detected and revoked in time; strong identity controls and token lifecycle management would have prevented the attacker from publishing to PyPI and Docker.","published","2026-10-23T10:21:21.861004+00:00","2026-10-23T10:21:21.843+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.securityweek.com\u002Flitellm-compromised-in-fresh-supply-chain-attack\u002F","litellm-compromised-in-fresh-supply-chain-attack-01e5ec","LiteLLM Compromised in Fresh Supply Chain Attack",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[49,53,57],{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]