daily-hour-news·
🛡️LiteLLM Hack: One Unrevoked Key, 49,000 Poisoned Downloads
TL;DR
A master key leaked into a public GitHub repo on May 27 and was never revoked. In October an attacker used it to publish LiteLLM 1.107.0 with an infostealer, and Wiz counted about 49,000 downloads in under two hours.
A master key leaked into a public GitHub repo on May 27 and was never revoked. In October an attacker used it to publish LiteLLM 1.107.0 with an infostealer, and Wiz counted about 49,000 downloads in under two hours.
Key Points
1
Master key committed to the public LiteLLM-Labs/lite-harness repo on May 27; the commit was removed but the key was not rotated
Keep reading — it's free
Enter your email to keep reading — plus the best of AI & tech, daily. Free, forever.
Also get
or
Already a member? Sign in
Quick Facts
LiteLLMsupply chain attackPyPIAPI keysWizLLM gatewayAI security
Comments
Subscribe to join the conversation...
Be the first to comment