Wiz disclosed a supply chain attack on the LiteLLM PyPI package where a malicious version v1.107.0 stole credentials.
Wiz disclosed that a malicious version of LiteLLM 1.107.0 was uploaded to PyPI on October 21 at 11:39 UTC and isolated at 1:20 UTC. Related image tags on GHCR and Docker Hub were also compromised until their removal around 13:53 UTC. The latest secure version is now available.
Return to original text
A short introduction is retained here; the full text from the source website is not reposted. For specific wording and subsequent updates, please refer to the original article.
Open AIHOT original