EXPLORINEER
en

UK — The Register

LiteLLM supply chain attack started with an exposed master key

Security1 min read

LiteLLM, an open source tool that routes requests to AI models, was hit by a supply chain attack. The attack began with a master key that was accidentally posted on a public GitHub page and never replaced.

What happened

Someone uploaded a poisoned version (1.107.0) of LiteLLM to PyPI and its container registries. This version held malware that steals passwords and secret keys and can run any code on an infected computer. It was online for less than two hours before it was pulled, but it was downloaded about 49,000 times.

Key facts

  • The bad version was 1.107.0, and it was available for less than two hours.
  • About 49,000 downloads happened during that time, according to Wiz.
  • The master key was posted to a public GitHub repository on May 27.
  • The attacker used the key on October 10 to get into LiteLLM's internal platform.

How the attack spread

A configuration file with a master key was posted to a public GitHub repository. The team removed the file quickly but did not cancel the key. The attacker then used that key to get a GitHub login token. This token gave them owner-level access to all of LiteLLM's GitHub repositories. From there, they stole more login tokens from two engineers and from other internal systems.

Why it matters

The attacker could make changes that looked like they came from trusted engineers, so the changes did not raise suspicion. The malware also targeted many kinds of secrets, including cloud logins, browser cookies, and API keys for AI companies such as OpenAI and Anthropic. The lesson is clear: when a key is exposed, it must be replaced right away.

What to do now

  • If you installed version 1.107.0, assume any credentials on that system may have been stolen.
  • Check affected systems and look for signs of misuse.
  • Change passwords and replace all exposed keys and tokens.
  • Watch for LiteLLM's further updates on the investigation.

Glossary

LiteLLM
An open source tool that helps software send requests to many AI models through one system.
PyPI
A public library where Python programmers download free software packages.
GitHub
A website where developers store, share, and work on code together.

Same story, different eyes

More in this topic

SecurityZDNet Korea

"Threatening the Entire Server Ecosystem"... After PHP, Security Vulnerability Found in Node.js Too

A critical vulnerability dubbed "Node2shell" (CVE-2026-111497) has been found in Node.js, the JavaScript server runtime, following a similar PHP flaw. AI offensive security firm Theori says it reproduced and verified the flaw, which stems from an out-of-bounds write in the Brotli decompression module and can allow denial of service or remote code execution without authentication. Node.js versions 22.x, 24.x, and 26.x without the latest security patches are affected, and Theori urges immediate updates to 22.23.4, 24.22.1, or 26.12.1 or later.

SecurityITmedia

Bandai Namco Logistics Subsidiary Hit by Unauthorized Access, Possible Leak of "Ichiban Kuji ONLINE" Delivery Data

Bandai Namco Holdings announced on October 26 that unauthorized access to a system managed by its logistics subsidiary Bandai Logipal may have leaked delivery information for "Ichiban Kuji ONLINE." The possibly exposed data includes names, addresses, and phone numbers, and no credit card information is included; the number of affected people is still under investigation, and no misuse has been confirmed so far. The company has reported the incident to the police and the Personal Information Protection Commission and urged potentially affected individuals to be wary of suspicious calls or mail.

Securityheise online

Cloudflare CEO Expects Many More Flaws Like php2shell

Cloudflare CEO Matthew Prince told Reuters that the recently disclosed php2shell and Broccoli2Shell vulnerabilities are only the beginning, and that for years weekly alarms like these may occur as more people use AI to search for security flaws. He said Cloudflare knows of several other serious vulnerabilities in critical software components but did not name the affected projects. Security firms such as VulnCheck and secuvera also expect the time between vulnerability discovery and attacks to keep shrinking.

SecurityThe Register

Microsoft releases emergency .NET security fixes for Google Brotli bug

Microsoft has issued an out-of-band security update for .NET 8, 9, 10, and 11 to patch a buffer overflow in Google's Brotli compression library, tracked as CVE-2026-111497 and rated 8.1 under CVSS v3.1. The flaw could let an unauthenticated attacker read or corrupt process memory, leading to information disclosure, denial of service, or elevation of privilege. Microsoft's advisory says exploitation is "More Likely," though it found no evidence yet that criminals are using working exploits in attacks.