[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkRKQSemyK8uefB8gpoHZvVM5UXRJwCOGdQQ8WTYbV08":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"ec4c8bd8-b548-442d-a2ce-4b011a8f67c5","unrevoked-api-key-enables-litellm-supply-chain-attack-49k-malicious-downloads","78e06723-4560-4327-8cde-58efeeaad753","Unrevoked API Key Enables LiteLLM Supply-Chain Attack, 49K Malicious Downloads","An API key accidentally exposed in May was never revoked, giving an attacker persistent, privileged access to LiteLLM's GitHub repositories months later. This single oversight allowed the adversary to poison a widely-used open-source package on PyPI, resulting in approximately 49,000 downloads of credential-harvesting malware. The stolen cloud credentials were immediately weaponized to access AWS AI services — a pattern known as LLMjacking — amplifying the damage far beyond the initial compromise. This incident illustrates that a leaked secret left unrevoked is functionally equivalent to handing an attacker a permanent key to your infrastructure.","**Immediate actions:**\n- Audit and revoke all exposed or potentially compromised API keys, tokens, and secrets immediately upon discovery.\n- Remove or quarantine the malicious PyPI package version and notify downstream users to downgrade or upgrade to a clean release.\n- Rotate all cloud credentials (AWS, etc.) associated with affected projects and review IAM access logs for unauthorized usage.\n\n**Long-term improvements:**\n- Implement automated secret scanning in CI\u002FCD pipelines (e.g., GitHub Advanced Security, Trufflehog) to detect and block committed secrets before they reach public repositories.\n- Adopt short-lived, scoped credentials and enforce automatic expiration policies so that any leaked secret becomes useless within a defined window.\n- Establish a formal secrets lifecycle management process that mandates immediate revocation upon any suspected exposure, with ownership assigned to a named team.\n\n**Detection measures:**\n- Enable anomaly detection and alerting on cloud accounts (AWS CloudTrail, GuardDuty) to flag unusual API calls such as new AI service provisioning from unfamiliar identities.\n- Monitor package publishing pipelines for unexpected releases or changes to maintainer accounts, and use package signing (Sigstore\u002FPyPI Trusted Publishers) to verify integrity.",[12,13,14,15,16,17,18],"CIS Control 5: Account Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components","CIS Control 17: Incident Response Management",{"MITRE ATT&CK T1566: Phishing":20,"CIS Control 5: Account Management":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 17: Incident Response Management":23,"OWASP A06:2021 Vulnerable and Outdated Components":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"While not phishing directly, the attacker's technique of distributing a malicious package to harvest credentials maps to supply-chain compromise methods that abuse trusted channels — analogous to the deceptive delivery mechanism ATT&CK tracks under credential access via trojanized software.","The incident stemmed from a failure to revoke a compromised credential; CIS Control 5 requires organizations to actively manage the lifecycle of all credentials, including immediate revocation of exposed secrets.","Failing to revoke the exposed key is analogous to leaving a known vulnerability open; SI-2 requires organizations to remediate identified weaknesses — including credential exposures — within defined timeframes.","The failure to act on the May key exposure before it led to a full supply-chain attack highlights the absence of a structured incident response process; CIS Control 17 requires organizations to establish and exercise response procedures so that identified exposures are escalated and remediated promptly.","The 49,000 users who downloaded the poisoned LiteLLM package were exposed because they consumed a compromised third-party component without integrity verification, which A06 specifically addresses by requiring controls around third-party and open-source software supply chains.","The exposed API key represented a known technical weakness that was not remediated, violating the requirement to identify and address vulnerabilities in a timely manner before they can be exploited.","The unrevoked API key provided ongoing unauthorized access to critical repositories; PR.AA calls for managing credentials and access rights to prevent exactly this kind of persistent privilege abuse.","published","2026-10-26T13:21:08.556985+00:00","2026-10-26T13:21:08.538+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Ftherecord.media\u002Flitellm-hackers-ai-malware","popular-ai-tool-litellm-says-unrevoked-key-allowed-hackers-to-target-users-bab6fc","Popular AI tool LiteLLM says unrevoked key allowed hackers to target users",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"6d211e7d-c835-4a7b-965d-11a96685f5fd","2026-10-26","afternoon","ThreatNoir Afternoon Brief — October 26","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-10-26\u002Fthreatnoir-afternoon-brief-2026-10-26.mp3",[55,59,63],{"slug":56,"name":57,"problem":58},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":60,"name":61,"problem":62},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":64,"name":65,"problem":66},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]