malware
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
Medium
Summary
LiteLLM disclosed a significant security incident where threat actors exploited a compromised release pipeline to push a malicious version of the LiteLLM Python package. The attack leveraged compromised GitHub CLI credentials and involved techniques mirroring a previous attack in March 2026, and the attackers subsequently abused stolen credentials to validate AWS instance role credentials.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data