LiteLLM supply chain attack traced to master key exposed on GitHub in May
Poisoned package drew about 49,000 downloads before it was quarantined
LiteLLM has traced last week's supply chain attack to a master key it accidentally committed to a public GitHub repository in May, according to a postmortem published Friday. The compromise led to a poisoned version of the popular open source AI gateway being uploaded to PyPI and container registries, where it was downloaded about 49,000 times in less than two hours, security firm Wiz said.