[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgF-Q577oFJgvfx4JQ-EcrVa-Qa8ggucatd60VzmpJlg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":53,"controls":54},"74058989-9570-4c68-85d2-3c81d8093c4e","litellm-supply-chain-attack-stolen-credentials-and-undetected-malicious-workflows","457c91ec-bbdc-4746-8919-7da10f8d576e","LiteLLM Supply Chain Attack: Stolen Credentials and Undetected Malicious Workflows","An attacker gained access to the LiteLLM GitHub organization by exploiting a master key that was accidentally committed to the repository, using it to steal credentials and plant secret-exfiltration workflows eleven days before the supply chain attack was detected. This extended dwell time demonstrates a critical failure in monitoring repository activity and detecting anomalous workflow behavior. The compromised access allowed the attacker to approve a malicious release, poisoning downstream users of the package. This incident highlights how a single secrets management mistake can cascade into a full supply chain compromise affecting all consumers of a widely-used library.","**Immediate actions:**\n- Rotate all secrets, tokens, and API keys immediately upon discovering any accidentally committed credentials in version control history.\n- Audit all GitHub Actions workflows and recent repository activity for unauthorized modifications or suspicious exfiltration steps.\n- Enable GitHub's secret scanning and push protection features to block and alert on committed credentials in real time.\n\n**Long-term improvements:**\n- Enforce mandatory code review and multi-party approval for all CI\u002FCD pipeline changes, including GitHub Actions workflow files.\n- Implement least-privilege access controls for GitHub organization members and service accounts, restricting who can approve and publish releases.\n- Store all secrets in a dedicated secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) and never hardcode credentials in source code or configuration files.\n\n**Detection measures:**\n- Deploy continuous monitoring and alerting on repository events such as new workflow file additions, permission changes, and artifact publication.\n- Integrate Software Composition Analysis (SCA) and artifact integrity verification (e.g., sigstore\u002Fcosign) into the software supply chain to detect tampered packages before deployment.",[12,13,14,15,16,17,18],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components",{"MITRE ATT&CK T1566: Phishing":20,"NIST SP 800-53 SI-2: Flaw Remediation":21,"CIS Control 17: Incident Response Management":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":24,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"While the initial vector was an accidentally committed key rather than phishing, the subsequent credential theft and lateral movement mirror the credential-harvesting objectives that ATT&CK T1078 (Valid Accounts) and supply-chain techniques describe, underscoring the need for monitoring anomalous use of legitimate credentials.","Prompt detection and rotation of the accidentally committed master key represents a fundamental flaw remediation obligation; failing to do so allowed the attacker to leverage it for eleven days undetected.","An eleven-day gap between initial compromise and detection indicates the absence of a practiced incident response process capable of identifying and containing suspicious repository activity in near-real time.","Downstream consumers of LiteLLM who had no artifact integrity verification in place inadvertently deployed compromised components, exactly the risk OWASP A06 warns against when third-party dependencies are not validated before use.","Systematic management of vulnerabilities—including secrets exposure in version control—requires processes to detect, assess, and remediate such issues before attackers can exploit them.","Enforcing repository security configurations—such as branch protection rules, required reviewers for workflow changes, and push protection—would have prevented the attacker from silently modifying CI\u002FCD workflows.","Strict identity and access management—including scoped tokens and multi-party release approvals—would have limited the attacker's ability to approve and publish malicious artifacts after stealing credentials.","published","2026-10-23T22:20:25.288062+00:00","2026-10-23T22:20:25.262+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fsocket.dev\u002Fblog\u002Flitellm-attack-timeline?utm_medium=feed","new-evidence-shows-litellm-secret-stealing-workflows-ran-11-days-before-supply-c-b10aa3","New Evidence Shows LiteLLM Secret-Stealing Workflows Ran 11 Days Before Supply Chain Attack",[35,41,47],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":42,"name":43,"slug":44,"description":45,"color":46},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":48,"name":49,"slug":50,"description":51,"color":52},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[],[55,59,63],{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]